Windows Process Monitoring and Management Tool
About
This project is a demonstration of a set of process monitoring and management techniques used mainly in various security applications.
It is a Windows process monitoring tool, which includes a driver to monitor process start. This driver collects and reports process details to user mode and can allow or block its start.
Project Structure
.\bin - folder with binary files
.\lib - folder with library files
.\obj - folder with object files
.\procmon - folder with source files
|-> .\Common – Common files and projects
|-> .\DrvCppLib - Kernel Library to develop driver in C++.
|-> .\ DrvSTLPort - Directory with STLPort 4.6 ported for using in windows drivers.
|-> .\ includes - Includes that are common for user and driver
|-> .\ processdll - Main DLL that has all API
|-> .\ procmon - Driver project
|-> .\ ProcMonGUI - GUI that is written using MFC
Implementation
x64/x86 architectures are supported.
Please note that the provided code only illustrates the process blocking technique and cannot be used in a commercial solution as-is.
You can find step-by-step code explanation and technology details in the [related article] (https://www.apriorit.com/dev-blog/254-monitoring-windows-processes).
License
Licensed under the MIT license. © Apriorit.