基于HOOK进程监控的设计与实现

钩子是Windows操作系统提供的一种在保护模式下截获系统信息的机制。利用消息钩子能够截获系统或应用程序发出的消息。基于这一特性可以截取进程创建消息从而达到监控进程的目的。本文在分析钩子的工作原理和使用钩子的关键技术点基础上，利用Windows提供的消息钩子函数设计并实现了一个进程监控程序，分析了程序的实现过程，给出了程序的监控效果及不足之处。

The Design and Implementation of HOOK-Based Process Control Program

Hook is a Windows mechanism used to capture the system information under the Protected Mode.Message Hook capture the message send by the system or a application program,using this feature can capture the creating process information so as to achieve the purpose of monitoring the process.The article firstly analyze the Hook's working principle and the key technologies while using Hook;and then use the Message Hook function provided by Windows to design a program monitoring process,also analyze the implementa...