识别一个程序是否已经开始

Question

我想开发一个windows应用程序来监视一个程序是否已经启动（可以说windows计算器）以及它已经使用了多长时间的时间。我知道我可以对这个过程进行调查，看看它是否开启，但我不确定这是否是最好的解决方案。

我正在考虑全球系统钩子，但经过几个小时后，我的结果比从我开始时更困惑。有没有关于如何做我想要的或只是一些想法的任何教程的指针。这是需要全局钩子还是其他更好？

我不介意使用C＃或C++，所以请随时指出任何相关的教程或文档。

感谢

Answer 1

检查过程信息（使用轮询）

Process [] processes = Process.GetProcessesByName("notepad"); 
if(processes.Length > 0) 
    processes[0].StartTime; 

使用本地Windows（WMI）的API注册一个事件：

using System; 
using System.ComponentModel; 
using System.Collections; 
using System.Globalization; 
using System.Management; 

namespace WMI.Win32 
{ 
    public delegate void ProcessEventHandler(Win32_Process proc); 
    public class ProcessWatcher : ManagementEventWatcher 
    { 
     // Process Events 
     public event ProcessEventHandler ProcessCreated; 
     public event ProcessEventHandler ProcessDeleted; 
     public event ProcessEventHandler ProcessModified; 

     // WMI WQL process query strings 
     static readonly string WMI_OPER_EVENT_QUERY = @"SELECT * FROM 
__InstanceOperationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'"; 
     static readonly string WMI_OPER_EVENT_QUERY_WITH_PROC = 
      WMI_OPER_EVENT_QUERY + " and TargetInstance.Name = '{0}'"; 

     public ProcessWatcher() 
     { 
      Init(string.Empty); 
     } 
     public ProcessWatcher(string processName) 
     { 
      Init(processName); 
     } 
     private void Init(string processName) 
     { 
      this.Query.QueryLanguage = "WQL"; 
      if (string.IsNullOrEmpty(processName)) 
      { 
       this.Query.QueryString = WMI_OPER_EVENT_QUERY; 
      } 
      else 
      { 
       this.Query.QueryString = 
        string.Format(WMI_OPER_EVENT_QUERY_WITH_PROC, processName); 
      } 

      this.EventArrived += new EventArrivedEventHandler(watcher_EventArrived); 
     } 
     private void watcher_EventArrived(object sender, EventArrivedEventArgs e) 
     { 
      string eventType = e.NewEvent.ClassPath.ClassName; 
      Win32_Process proc = new 
       Win32_Process(e.NewEvent["TargetInstance"] as ManagementBaseObject); 

      switch (eventType) 
      { 
       case "__InstanceCreationEvent": 
        if (ProcessCreated != null) ProcessCreated(proc); break; 
       case "__InstanceDeletionEvent": 
        if (ProcessDeleted != null) ProcessDeleted(proc); break; 
       case "__InstanceModificationEvent": 
        if (ProcessModified != null) ProcessModified(proc); break; 
      } 
     } 
    } 

    // Auto-Generated running: mgmtclassgen Win32_Process /n root\cimv2 /o WMI.Win32 
    // Renaming the class from Process to Win32_Process 
    public class Win32_Process { ... } 
} 

// Sample Usage 
ProcessWatcher procWatcher = new ProcessWatcher("notepad.exe"); 
procWatcher.ProcessCreated += new ProcessEventHandler(procWatcher_ProcessCreated); 
procWatcher.ProcessDeleted += new ProcessEventHandler(procWatcher_ProcessDeleted); 
procWatcher.ProcessModified += new ProcessEventHandler(procWatcher_ProcessModified); 
procWatcher.Start(); 

// Do Work 

procWatcher.Stop();