Hooking CreateProcess?

[Logic_Bomb]

Hey Guys,

A short(ish) question from me - I am trying to work out how to hook the windows CreateProcess routines so that I can detour through the code in my application before any new processes are created on a system. Examples of this can be seen in programs such as ZoneAlarm where you are asked to Allow or Deny a new process to run before it is actually spawned. I have played around with Suspending/Resuming the process using PsAPI and tlhelp32 (jwatlhelp32), but neither of these are responsive enough to be of any use, since using those requires me to loop through all the running processes and check for new ones. It would be a lot easier and quicker if I could simply hook the windows 7 createprocess routines and detour through my code before the process is created.

Any ideas? Suggestions? Or a better method of doing this?

Thanks and Regards,

Logic_

[taazz]

Below is the most comprehensive page I could find in a short time.

http://forum.sysinternals.com/createprocess-api-hook_topic13138.html

Read the articles there to get an over view, c/c++ mainly.

http://www.internals.com/articles/apispy/apispy.htm
http://www.codeguru.com/cpp/w-p/system/misc/article.php/c5667/API-Hooking-Revealed.htm