[Done] process monitoring plugin

[DranDane]

Hi,

I'm trying to create a process monitoring plugin. The challenge, I never coded in python but I already did this in C#.

I would like to do exactly like the task plugin but for the processes (windows CTRL-ALT-DEL process list). I would like to create two new event

- created.xxx (where xxx is the process name)
- closed.xxx (where xxx is the process name)

I founded this (in french) http://www.developpez.net/forums/d38466 ... sus-cours/

Is it possible to create this plugin without installing special libraries ? Could you help me to start ?

[Pako]

Is it possible to create this plugin without installing special libraries ? Could you help me to start ?

I probably does not understand exactly what you need.
Maybe this will help you: http://mail.python.org/pipermail/python ... 06174.html
I already use and it works.
Pako

[DranDane]

I would like to raise an event on process creation/destruction. Exactly like the Task plugin does for the task but for the process.

[Pako]

I would like to raise an event on process creation/destruction. Exactly like the Task plugin does for the task but for the process.

I understand it before, but I am not entirely sure you what you mean by the following:

Is it possible to create this plugin without installing special libraries ?

Pako

[Bitmonster]

There is a function called GetProcessDict() in eg.cFunctions coded in C (and therefore should be fast) that should help. It returns a dict where the keys are the PIDs and the values are the names of the processes. I just hacked this script together:

Code: Select all

from eg.cFunctions import GetProcessDict
from threading import Thread
from time import sleep
from os.path import splitext


def ThreadFunc():
    oldProcesses = GetProcessDict()
    oldPids = set(oldProcesses.iterkeys())
    
    while True:
        newProcesses = GetProcessDict()
        newPids = set(newProcesses.iterkeys())
        for pid in newPids.difference(oldPids):
            name = splitext(newProcesses[pid])[0]
            eg.TriggerEvent("Created." + name, prefix="Process")
        for pid in oldPids.difference(newPids):
            name = splitext(oldProcesses[pid])[0]
            eg.TriggerEvent("Destroyed." + name, prefix="Process")
        oldProcesses = newProcesses
        oldPids = newPids
        sleep(0.1)
        
Thread(target=ThreadFunc).start()

[DranDane]

Are you sure because if i add this line to my script :

Code: Select all

from eg.cFunctions import GetProcessDict

The loading of the module fails. I get a "Process not found" error message.

[DranDane]

Hi Bitmonster,

Is GetProcessDict in the latest (0.3.5c.908) release version ?

Are you building the cFunctions library with Visual Studio ?

[Pako]

Last beta version (0.3.6.1487) included GetProcessDict and it works very nicely.
Plugin is actually already finished.
Pako

[DranDane]

Where can I dowload this beta version ? On the sourceforge page I can only download the 3.5c.

EDIT -- OK found (http://www.eventghost.org/downloads/) Thanks to google

And now I see the answer is on the main wiki page. I must learn to read.

[DranDane]

Hello,

The code for the process plugin is done. I did the easiest part. Thank you Bitmonster for the GetProcessDict function and the example. I know nothing about Python so I did a simple mix between the example of Bitmonster and the code from the DirectoryWatcher module :

Code: Select all

eg.RegisterPlugin(
    name = "Process Watcher",
    author = "Bitmonster & DranDane",
    version = "1.0.",
    description = (
        "Generates events if a process is created or destoyed"
    ),
    icon = (
        "iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAABuklEQVR42o1Sv0tCYRQ9"
        "L1FccpCEB73wVy1NjTrUPxD1lgZp0dWKaAhXxWhoyWgoIUjHBEH65RSE0CAUgWIPLAqR"
        "gkAQIQXR8nW/Z0ai6btweJfDd847934fhz8VCARkqCjTmBGra+sc67kOGQqFZIfDMVCo"
        "1WphMpng9/vxkMvi9u6e4zp/ZmStVkOpVOor1mg00Ol0CIfDKBQK/Q1isRhcLhedJpIn"
        "vHXkI+D5SUSj+0in0wMM4mSw6WqL9whLhHeCYAA/tobo9twQgxsyEMjglUj6IE7YIJxQ"
        "gk9K8DwsgTLCMjGGdvJxJibMUgJ+hUaYGWyQSCQQDO7+ZO8uo1EHn8/2v4Hb7UYmkxl4"
        "jY1GA9lsFrlcDl+fDZxfJNsGHo9H1QNiVa/XlQSiuIAp2wS466ukHNjaUauHXq+H0+n8"
        "HYPrzF+pVHriSpLUxbGHJAgCIpFIr0EqlYI0KmH6Y1o5XC6XaaFBpW+1WqhWq7BYLLRI"
        "X9ciFQNRFJHP53FoO4T3xdsTu9lsolgswm63Kz1b9tPTI6xmAVzk+Eg+PbtUvQNWstxS"
        "xHv7B+1bEBfnVd8CK6vFrIhZ/w1wBAQrC42uqQAAAABJRU5ErkJggg=="
    ),
)

from eg.cFunctions import GetProcessDict
from threading import Thread
from time import sleep
from os.path import splitext
import threading
from eg.WinApi.Dynamic import (
# functions:
    CreateEvent,
    PulseEvent,
)

class Process(eg.PluginClass):

    def __start__(self):
        self.stopEvent = CreateEvent(None, 1, 0, None)
        self.startException = None
        startupEvent = threading.Event()
        self.thread = threading.Thread(
            target=self.ThreadLoop, 
            name="ProcessWatcherThread", 
            args=(startupEvent,)
        )
        self.thread.start()
        startupEvent.wait(3)
        if self.startException is not None:
            raise self.Exception(self.startException)
              
    def __stop__(self):
        if self.thread is not None:
            PulseEvent(self.stopEvent)
            self.thread.join(5.0)

    def ThreadLoop(self, stopThreadEvent):
        oldProcesses = GetProcessDict()
        oldPids = set(oldProcesses.iterkeys())
   
        while True:
            newProcesses = GetProcessDict()
            newPids = set(newProcesses.iterkeys())
            for pid in newPids.difference(oldPids):
                name = splitext(newProcesses[pid])[0]
                eg.TriggerEvent("Created." + name, prefix="Process")
            for pid in oldPids.difference(newPids):
                name = splitext(oldProcesses[pid])[0]
                eg.TriggerEvent("Destroyed." + name, prefix="Process")
            oldProcesses = newProcesses
            oldPids = newPids
            sleep(0.1)

Could you to add this to the SVN ?

[Wagner]

I've added FindProcess and CloseProcess actions in the manner as the similar Window functions, and while it's mostly working, I'm having some problems. Every time I close and re-open EG to reload the module, the actions have detached, and I get a...

Code: Select all

Can't find action: Process.FindProcess(u'XWin.exe')
Can't find action: Process.CloseProcess()

When I recreate the actions, it works fine, but obviously I'm doing something wrong.

[jesterod]

so can this be used to kill a process?