External events

[Jani]

Hello,

Is there any other way to receive an external event, except the EventGhost.exe -event myEvent way? I think creating a new process is quite heavy if you plan to send external events to EventGhost frequently. A window message would one way?

[stottle]

Several things come to mind. Lot's of plugins start their own thread to watch for events from other apps (theatertek sends events over tcp/ip for example). There's also the network send/receive plugins. Finally, when you run an event from the command line, it sends the event to a COM instance that EG starts. If you want to send lot's of messages, you could connect to that instance and keep the reference to send more messages.

Probably any of these options involves so coding unless there's already a plugin that "sees" the events you want to respond to.

Brett

[Jani]

I'm thinking of doing a real task watcher (opposed to the current one) and I'm looking for the best solution to send the exe name for EG. I thought about UDP, but then I thought loading winsock in every app I hook my DLL to isn't very nice. Atm I'm looking at NamedPipes, if they provided a better solution. Hence I need some way which doesn't utilize too much CPU when a process is launched.

[stottle]

I'm using namedpipes with the MceRemote Vista/Win7 plugin. Works pretty well. I'd like to know what you mean by a "real task watcher". Mind elaborating?

BTW, the current code hooks into windows calls, so you might consider patching that instead of starting over.

Brett

[Jani]

I'd like to know what you mean by a "real task watcher".

Current one uses a hook which only gets notified when a window is created or destroyed. So, minimizing eg. Foobar2000 will say it was closed. Well, that's what I figured out by seeing how it behaves, I haven't checked any source code. So, I'm planning to do this properly.

First I thought I'd just loop EnumProcesses, which would've been fine. For this method, I needed a way to transport the message. Anyway, then I thought this is my chance to learn some kernel programming and that's what I'm doing now. I've written a driver which captures all process events, because it's hooked into a notify chain. In this case the process is isn't polled, so no process will be missed. Now I only need a way to transfer this message from Windows kernel to EventGhost. I'm still trying to find that out.

Using APC I could send two UINTs out from the kernel and create some kind of process image name specific hash or something. On the other hand, using IOCTLs I might run into a problem where more processes is started than the client can read, altho it's unlikely. I'm just a bit of perfectionist. I need to read a bit more about communicating with usermode.

Of course I could pass out the PID, but then I couldn't find the image file name for deleted processes. Ie. process might've been deleted already, when the usermode client tries to find out the image filename by the PID.

Sorry for late reply, I've been a little busy with other stuff.

[Pako]

Maybe here (Posted: Tue Jan 27, 2009 11:18 am) is a plugin that you are looking for.
Pako

[Jani]

Yeps, seems so. Well, mine is more efficient, but on the other hand a lot more dangerous, since it's a driver and also because Win7 doesn't like testsigned drivers :p