Page 1 of 1
Easiest way to know if your target app was closed?
Posted: Tue Jun 15, 2004 5:02 pm
by Claes
Hi!
I succesfully injected a DLL into a targetapp. Now, if this app. is closed, I would like to know that this happended in my own app. What's the easiest way to do this? Would it be to hook TerminateProcess?
- Claes
Posted: Wed Jun 16, 2004 10:04 am
by madshi
No, just call WaitForSingleObject(processHandle, ...). If you want to be notified (instead of waiting for that event) you can do that in a little secondary thread.
Posted: Thu Jun 17, 2004 11:51 am
by nildo
madshi wrote:No, just call WaitForSingleObject(processHandle, ...). If you want to be notified (instead of waiting for that event) you can do that in a little secondary thread.
Does this WaitForSingleObject consumes CPU usage? Or the code just get stopped into tat point until processHandle = 0 ?
Posted: Thu Jun 17, 2004 12:37 pm
by madshi
It doesn't consume CPU usage. It just waits...
Posted: Fri Jun 18, 2004 3:01 pm
by nildo
Madshi, I was trying to do it.... But even in another thread my program stays frozen. Look at this:
Here is the thread source:
Code: Select all
TAguardaProcThread = class( TThread )
protected
procedure Execute; override;
procedure AguardaProc; virtual;
public
constructor Create;
end;
(...)
constructor TAguardaProcThread.Create;
begin
inherited Create( True );
FreeOnTerminate := True;
Priority := tpNormal;
end;
procedure TAguardaProcThread.Execute;
begin
Synchronize( AguardaProc );
end;
procedure TAguardaProcThread.AguardaProc;
begin
WaitForSingleObject( Processo.Handle, INFINITE );
Processo.Ativo := False;
end;
Here I create the Thread
Code: Select all
fAguardaProc := TAguardaProcThread.Create;
fAguardaProc.Resume;
Do you know whats happening?
Posted: Fri Jun 18, 2004 4:18 pm
by madshi
"TThread.Synchronize" does nothing but move execution of the synchronized method to the main thread!
Posted: Fri Jun 18, 2004 6:04 pm
by nildo
madshi wrote:"TThread.Synchronize" does nothing but move execution of the synchronized method to the main thread!
hehe, sorry!
Posted: Thu Jun 24, 2004 12:06 pm
by Claes
I tried this. But I'm not sure where to put the call to WaitForSingleObject. Only once during Create - or in the Execute method? And how do I catch the signal?
Code: Select all
unit ThreadUnit;
interface
uses
Windows, Classes;
type
TWait4ProcessThread = class(TThread)
private
{ Private declarations }
protected
procedure Execute; override;
public
constructor Create(ProcId: THandle);
end;
implementation
{ TWait4ProcessThread }
constructor TWait4ProcessThread.Create(ProcId: THandle);
begin
inherited Create(True);
FreeOnTerminate := True;
Priority := tpTimeCritical;
WaitForSingleObject(ProcId, INFINITE);
Resume;
end;
procedure TWait4ProcessThread.Execute;
begin
if not Terminated then
begin
???
end;
end;
end.
Create the thread:
Code: Select all
uses
...
ThreadUnit;
var
Wait4ProcessThread: TWait4ProcessThread;
...
Wait4ProcessThread := TWait4ProcessThread.Create(ProcessHandle);
Thanks in advance...
- Claes
Posted: Thu Jun 24, 2004 12:16 pm
by nildo
Put on EXECUTE
Posted: Thu Jun 24, 2004 12:29 pm
by Claes
Thanks! It works now.