luacom中使用WMI监视进行的创建和关闭。还是挺酷的。然后打开一个Notepad.exe,再关闭它,就能看到两行输出。
package.cpath=[[C:\Program Files\Lua\5.1\clibs\?.dll]]
require "luacom"
strComputer = "mycomputername"
objWMIService = luacom.GetObject("winmgmts:{impersonationLevel=Impersonate}!\\\\"..strComputer.."\\root\\cimv2")
cSink = luacom.CreateObject( "WbemScripting.SWbemSink")
dSink = luacom.CreateObject( "WbemScripting.SWbemSink")
cSinkh = {}
function cSinkh:OnObjectReady(objObject, objAsyncContext)
print ("Process Create Detected: ",objObject:TargetInstance ():Name())
end
function cSinkh:OnCompleted(objObject, objAsyncContext)
print ("Completed")
end
dSinkh = {}
function dSinkh:OnObjectReady(objObject, objAsyncContext)
print ("Process Delete Detected: ",objObject:TargetInstance ():Name())
end
function dSinkh:OnCompleted(objObject, objAsyncContext)
print ("Completed")
end
objWMIService:ExecNotificationQueryAsync( dSink, "SELECT * FROM __InstanceDeletionEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'")
objWMIService:ExecNotificationQueryAsync (cSink, "SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'")
luacom.Connect (cSink,cSinkh)
luacom.Connect (dSink,dSinkh)
luacom.StartMessageLoop()