Child Process Detection

Question

Is there a way (in C ++ and Windows XP) to detect if one process spawns other processes?

eg,

write.exe in system32 spawns wordpad.exe then disappears, is there a function that tells me if the process is about to do this?

for those who are interested, I solved the problem using this msdn section:
http://msdn.microsoft.com/en-us/library/aa390425 (v = VS.85) .aspx

Answer 1

Win32 API . WMI Win32_ProcessStartTrace. #, . WMI ++ , , MSDN.

, . , WMI ​​ , , , . , , , . .

Answer 2

, . , ( , ). , , , , .

CreateToolhelp32Snapshot, Process32First Process32Next . PROCESSENTRY32, th32ParentProcessID.

; CreateProcess, .

Answer 3

I think you need to create a global DLL map that is bound to every running process. The DLL then finds the place where the call to the CreateProcess function maps to the actual CreateProcess from kernel32 and modifies the entry in the table to redirect the call to its own code in order to “discover” the CreateProcess call. All of this assumes that some user firewalls will not interfere with the execution of your global host.