識別一個程序是否已經開始

Question

我想開發一個windows應用程序來監視一個程序是否已經啓動（可以說windows計算器）以及它已經使用了多長時間的時間。我知道我可以對這個過程進行調查，看看它是否開啓，但我不確定這是否是最好的解決方案。

我正在考慮全球系統鉤子，但經過幾個小時後，我的結果比從我開始時更困惑。有沒有關於如何做我想要的或只是一些想法的任何教程的指針。這是需要全局鉤子還是其他更好？

我不介意使用C＃或C++，所以請隨時指出任何相關的教程或文檔。

感謝

Answer 1

檢查過程信息（使用輪詢）

Process [] processes = Process.GetProcessesByName("notepad"); 
if(processes.Length > 0) 
    processes[0].StartTime; 

使用本地Windows（WMI）的API註冊一個事件：

using System; 
using System.ComponentModel; 
using System.Collections; 
using System.Globalization; 
using System.Management; 

namespace WMI.Win32 
{ 
    public delegate void ProcessEventHandler(Win32_Process proc); 
    public class ProcessWatcher : ManagementEventWatcher 
    { 
     // Process Events 
     public event ProcessEventHandler ProcessCreated; 
     public event ProcessEventHandler ProcessDeleted; 
     public event ProcessEventHandler ProcessModified; 

     // WMI WQL process query strings 
     static readonly string WMI_OPER_EVENT_QUERY = @"SELECT * FROM 
__InstanceOperationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'"; 
     static readonly string WMI_OPER_EVENT_QUERY_WITH_PROC = 
      WMI_OPER_EVENT_QUERY + " and TargetInstance.Name = '{0}'"; 

     public ProcessWatcher() 
     { 
      Init(string.Empty); 
     } 
     public ProcessWatcher(string processName) 
     { 
      Init(processName); 
     } 
     private void Init(string processName) 
     { 
      this.Query.QueryLanguage = "WQL"; 
      if (string.IsNullOrEmpty(processName)) 
      { 
       this.Query.QueryString = WMI_OPER_EVENT_QUERY; 
      } 
      else 
      { 
       this.Query.QueryString = 
        string.Format(WMI_OPER_EVENT_QUERY_WITH_PROC, processName); 
      } 

      this.EventArrived += new EventArrivedEventHandler(watcher_EventArrived); 
     } 
     private void watcher_EventArrived(object sender, EventArrivedEventArgs e) 
     { 
      string eventType = e.NewEvent.ClassPath.ClassName; 
      Win32_Process proc = new 
       Win32_Process(e.NewEvent["TargetInstance"] as ManagementBaseObject); 

      switch (eventType) 
      { 
       case "__InstanceCreationEvent": 
        if (ProcessCreated != null) ProcessCreated(proc); break; 
       case "__InstanceDeletionEvent": 
        if (ProcessDeleted != null) ProcessDeleted(proc); break; 
       case "__InstanceModificationEvent": 
        if (ProcessModified != null) ProcessModified(proc); break; 
      } 
     } 
    } 

    // Auto-Generated running: mgmtclassgen Win32_Process /n root\cimv2 /o WMI.Win32 
    // Renaming the class from Process to Win32_Process 
    public class Win32_Process { ... } 
} 

// Sample Usage 
ProcessWatcher procWatcher = new ProcessWatcher("notepad.exe"); 
procWatcher.ProcessCreated += new ProcessEventHandler(procWatcher_ProcessCreated); 
procWatcher.ProcessDeleted += new ProcessEventHandler(procWatcher_ProcessDeleted); 
procWatcher.ProcessModified += new ProcessEventHandler(procWatcher_ProcessModified); 
procWatcher.Start(); 

// Do Work 

procWatcher.Stop();