Clase que Captura el Inicio y Cierre de Procesos [Aporte] [WMI]

[Keyen Night]

Bueno decidí compartir este código lo acabo de hacer sirve para capturar los procesos que se han iniciado y los que se han terminado, me parece bastante útil, utiliza como base WMI solo que en la clase está mucho más administrado y más cómodo de utilizar. Deben liberar el objeto con .Dispose cuando vayan a cerrar la aplicación que use la clase o lanza un error.

Código (vb.net) [Seleccionar] Expandir

Public Class ProcessWatcher

    Partial Class StoppedProcess

        Public Sub New(ByVal PropertiesDictionary As Dictionary(Of String, Object))

            Dim AllFlags As BindingFlags = &H107FF7F
            Dim Field As FieldInfo = Nothing

            For Each FieldProperty As KeyValuePair(Of String, Object) In PropertiesDictionary
                Field = Me.GetType.GetField("_" & FieldProperty.Key, AllFlags)
                If Field IsNot Nothing Then
                    Field.SetValue(Me, FieldProperty.Value)
                End If
            Next

        End Sub

#Region " Properties "

        Private _ProcessName As String
        Public ReadOnly Property ProcessName() As String
            Get
                Return _ProcessName
            End Get
        End Property

        Private _ProcessID As UInteger
        Public ReadOnly Property Id() As UInteger
            Get
                Return _ProcessID
            End Get
        End Property

        Private _ParentProcessID As UInteger
        Public ReadOnly Property ParentProcessId() As UInteger
            Get
                Return _ParentProcessID
            End Get
        End Property

        Private _ExitStatus As UInteger
        Public ReadOnly Property ExitCode() As UInteger
            Get
                Return _ExitStatus
                Process.GetCurrentProcess()
            End Get
        End Property

        Private _SessionID As UInteger
        Public ReadOnly Property SessionId() As UInteger
            Get
                Return _SessionID
            End Get
        End Property

#End Region

    End Class

    Public Event Started(ByVal e As Process)
    Public Event Stopped(ByVal e As StoppedProcess)

    Private ProcessQueryEvent_Start As WqlEventQuery
    Private ProcessWatcher_Start As ManagementEventWatcher

    Private ProcessQueryEvent_Stop As WqlEventQuery
    Private ProcessWatcher_Stop As ManagementEventWatcher

    Private WatcherEnabled As Boolean = False

    Public Sub New(Optional ByVal AutoStart As Boolean = True, _
                   Optional ByVal SetAsFalseCheckForIllegalCrossThreadCalls As Boolean = False, _
                   Optional ByVal Frequency As Double = 1000)

        ProcessQueryEvent_Start = New WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace")
        ProcessWatcher_Start = New ManagementEventWatcher(ProcessQueryEvent_Start)

        ProcessQueryEvent_Stop = New WqlEventQuery("SELECT * FROM Win32_ProcessStopTrace")
        ProcessWatcher_Stop = New ManagementEventWatcher(ProcessQueryEvent_Stop)

        AddHandler ProcessWatcher_Start.EventArrived, AddressOf StartEvent
        AddHandler ProcessWatcher_Stop.EventArrived, AddressOf StopEvent

        ProcessQueryEvent_Start.WithinInterval = TimeSpan.FromMilliseconds(Frequency)
        ProcessQueryEvent_Stop.WithinInterval = TimeSpan.FromMilliseconds(Frequency)

        Control.CheckForIllegalCrossThreadCalls = Not SetAsFalseCheckForIllegalCrossThreadCalls

        If AutoStart Then
            Enabled = True
        End If

    End Sub

    Private Sub StopEvent(ByVal sender As Object, ByVal e As EventArrivedEventArgs)

        Dim RawDictionary As New Dictionary(Of String, Object)

        For Each ProcessProperty As PropertyData In e.NewEvent.Properties
            If Not ProcessProperty.IsArray Then
                RawDictionary.Add(ProcessProperty.Name, e.NewEvent(ProcessProperty.Name))
            End If
        Next

        RaiseEvent Stopped(New StoppedProcess(RawDictionary))

    End Sub

    Private Sub StartEvent(ByVal sender As Object, ByVal e As EventArrivedEventArgs)
        RaiseEvent Started(Process.GetProcessById(e.NewEvent("ProcessID")))
    End Sub

    Public Property Frequency() As Double
        Get
            Return ProcessQueryEvent_Start.WithinInterval.TotalMilliseconds
        End Get
        Set(ByVal value As Double)
            If value < 0 Then
                Throw New ArgumentException("value")
            Else
                ProcessQueryEvent_Start.WithinInterval = TimeSpan.FromMilliseconds(value)
                ProcessQueryEvent_Stop.WithinInterval = TimeSpan.FromMilliseconds(value)
            End If
        End Set
    End Property

    Public Property Enabled() As Boolean
        Get
            Return WatcherEnabled
        End Get
        Set(ByVal value As Boolean)
            If WatcherEnabled Then
                ProcessWatcher_Start.Stop()
                ProcessWatcher_Stop.Stop()
            Else
                ProcessWatcher_Start.Start()
                ProcessWatcher_Stop.Start()
            End If
            WatcherEnabled = Not WatcherEnabled
        End Set
    End Property

    Public Sub Dispose()

        If Enabled Then
            ProcessWatcher_Start.Stop()
            ProcessWatcher_Stop.Stop()
        End If

        ProcessWatcher_Start.Dispose()
        ProcessWatcher_Stop.Dispose()

    End Sub

End Class


Un poco largo el código

Los parametros del constructor son:

AutoStart, Boolean, True para iniciar automáticamente con la construcción y False para iniciar después mediante la propiedad Enabled.

SetAsFalseCheckForIllegalCrossThreadCalls, Boolean, True para desactivar la detección de llamadas de controles fuera del MainThread y false para activar.

Frequency, Double, el intervalo en milisegundos en cuál se va a chequear.