Block process execution 1

[julianonunes]

Are there any way to detect any attempt of process initialization and block it before?

 

[chiph]

What user problem are you trying to solve?

Chip H.


____________________________________________________________________
If you want to get the best response to a question, please read FAQ222-2244 first

 

[julianonunes]

It's not a user problem, I want to make a program that detects an attempt of process inicialization, bring their information and block it (stop it).

 

[chiph]

Do you want to detect another instance of the current program being started, or some other arbitrary program being started?

Chip H.


____________________________________________________________________
If you want to get the best response to a question, please read FAQ222-2244 first

 

[julianonunes]

Other arbitrary program

 

[Sheco]

Anti-virus!

 

[julianonunes]

Guys, I'm a programmer and I need to CREATE a software that detects attempts of process initialization and block it before running.

I'm searching this on Google for a week and nothing....so if somebody could really help me I would thank you.

 

[chiph]

I've never tried this, and if you try it, be sure to do it inside a virtual machine so you don't hose your host OS. Because if I'm wrong, you surely will make your Win32 subsystem unstartable.

But, if you add a registry key under:

[tt]HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options[/tt]

for Explorer.exe, and added a sub-key named Debugger, whose value points to a program you write, that program might be able to reject the startup of the app that was started via Windows Explorer.

I got this information from Inside Windows NT, 2nd Ed. in the section on process startup.

If you aren't already familiar with the contents of the book and/or the DDK, you might want to abandon this project.

Chip H.


____________________________________________________________________
If you want to get the best response to a question, please read FAQ222-2244 first

 

[strongm]

PsSetCreateProcessNotifyRoutine

 

[julianonunes]

I got some information about API Hooking, so using this, I will intercept API calls that are made when a program tries to execute.

But I'll try your tips too.

 

[chiph]

Good one, strongm.

Chip H.


____________________________________________________________________
If you want to get the best response to a question, please read FAQ222-2244 first