Windows Forms - detecting an external application closing to trigger an event

Question

I am in need of a solution to trigger code when an external application is closing / closes.

I am unable to use System.Diagnostics Process.GetProcessByName to detect if the process is running since it might conflict with an anticheat system. I would need trigger the snippet of code only when the program closes and only then.

show us what you have so far. Remember, GetProcessByName uses the name, but without the .exe extension. — Andy
– Andy, Commented Aug 2, 2020 at 15:15
I just mentioned GetProcessByName as a solution that I can't use since it might trigger anti cheat although the program is not of a malicious nature, besides wasting system resources — Hazel
– Hazel, Commented Aug 2, 2020 at 15:28
You didn't say that in your question. You said "i am unable to use it" meaning you would be using it wrong. GetProcessByName works perfectly well. You can't use it because of an unorthodox reason that has nothing to do with the framework. — Andy
– Andy, Commented Aug 2, 2020 at 15:31
My bad on the wording, I'll go ahead and update it so it's a bit more obvious, thank you — Hazel
– Hazel, Commented Aug 2, 2020 at 15:33
If you can't use the Process object at all, you'll have to roll your own. I would start by looking at how the Process object works (referencesource.microsoft.com/#System/services/monitoring/…) if that doesn't help, then you are going to start to do some pretty hacky stuff: codeproject.com/Articles/2018/… — Andy
– Andy, Commented Aug 2, 2020 at 15:45

anti · Accepted Answer · 2020-08-02 19:23:43Z

0

I made a good, event-based implementation.

    class Monitor
    {
        public event EventHandler ProgramStarted;
        public event EventHandler ProgramClosed;

        public Monitor(string process)
        {
            string pol = "2";
            if (!process.EndsWith(".exe")) process += ".exe";

            var queryString =
                "SELECT *" +
                "  FROM __InstanceOperationEvent " +
                "WITHIN  " + pol +
                " WHERE TargetInstance ISA 'Win32_Process' " +
                "   AND TargetInstance.Name = '" + process + "'";

            var s = @"\\.\root\CIMV2";
            ManagementEventWatcher watcher = new ManagementEventWatcher(s, queryString);
            watcher.EventArrived += new EventArrivedEventHandler(OnEventArrived);
            watcher.Start();
        } 
        private void OnEventArrived(object sender, EventArrivedEventArgs e)
        {
            if (e.NewEvent.ClassPath.ClassName.Contains("InstanceDeletionEvent"))
            {
                EventHandler handler = ProgramClosed;
                handler?.Invoke(this, e);
            }
            else if (e.NewEvent.ClassPath.ClassName.Contains("InstanceCreationEvent"))
            {
                EventHandler handler = ProgramStarted;
                handler?.Invoke(this, e);
            }

        }
    }

To use it, you just create an instance of the class and set up the events. For example:

        static void Main(string[] args)
        {
            var mon = new Monitor("chrome");
            mon.ProgramClosed += Mon_ProgramClosed;
            mon.ProgramStarted += Mon_ProgramStarted;
            Console.ReadKey(true);
        }

        private static void Mon_ProgramStarted(object sender, EventArgs e)
        {
            MessageBox.Show("Program started.");
        }

        private static void Mon_ProgramClosed(object sender, EventArgs e)
        {
            MessageBox.Show("Program closed.");
        }

Make sure to add reference to System.Drawing if you're using a console app, and ,for winforms, adjust the modifiers.

answered Aug 2, 2020 at 19:23

anti

344 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Hazel Over a year ago

For some reason System.Management doesn't contain ManagementEventWatcher and EvenArrivedEventArgs in my .net framework 4.7.1 build of this form although the documentation clearly shows them being present learn.microsoft.com/en-us/dotnet/api/… Any ideas?

anti Over a year ago

@Hazel PLEASE ADD reference to System.Management in the references tab.

Hazel Over a year ago

I managed to figure it out, eventho System.Management is apart of the framework, I still needed the nugget package. I also read over the code a bit more in detail and as far as I understand it, it hooks directly to a program which might easily trigger any anticheat software which is what i'm trying to avoid since i do not want to get people banned for no reason. Thank you for the code though, even if I don't have any uses for it right now it's still fairly useful!

Collectives™ on Stack Overflow

Windows Forms - detecting an external application closing to trigger an event

1 Answer 1

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related