Question

Related to my question here, is it possible to create a window hook that will monitor if an application has been opened or not?

Most that I have found about hooks seem to focus on user input (keyboard press, mouse events), but I could not confirm if it is possible to know that the “double click” the user made is to open an application, or just to highlight a word.

Thank you.

Answer 1

Indeed, window hooks would not be sufficient. In fact for the task you are asking about you could use various strategies, such as:

1. enumerating the processes to find the one you’re looking for (Tool Help API or PSAPI)
2. enumerating the top-level windows on the desktop (but you’re limited to your desktop then)
3. check for a global or local event, mutex (or other kernel object) to deduce from that that some instance of the application is running
4. … or even from kernel PsSetCreateProcessNotifyRoutine

probably there are variations on the above plus some more.

In essence the question is whether you want to check for the process or for some other indicator that signifies whether the program you want to check for has been started.