preventing program execution
Posted on 2003-03-19
Dear genii, (genius - plural??)
I need to write a program to stop programs executing!
I've done research but seem to come accross problems with every idea possible solution i find.
I thought about using PsSetCreateProcessNotifyRoutine, but this seems to be called after the program has been started. if this is the case, then I'd need to terminate the program, which is obviously not a good idea. I need to sneak in somewhere between a request for, say, word.exe and the actual running of word.exe.
Then there's API hooking... system-wide API interceptor that monitors calls made to the CreateProcess function. But, from what I've heard, this doesnt cover all ways that the process can be started.
Then there's IAT (Import Address Table) Patching. Which is way beyond me! I'm just an MFC programmer who has been dropped into the world of system programming.
If anyone could tell me if there is an accepted method for doing this, it would be greatly appreciated. I'm already grey haired and I'm fast approaching baldnes...