Alternative new process detection?

[rcmaehl]

Hi all,

I'm looking for a way to detect if a new process has been created without running ProcessExists("") in a loop just eating 5% of CPU usage constantly. I need to be able to react quickly, is there any sort of Event Trigger I can make similar to OnEvent()?

Edited November 13, 2021 by rcmaehl

[JockoDundee]

Are you looking to detect a particular process that you know the name of, or every new proccess?

How quick is quick?

Have you no delay in your ProcessExists loop currently?

[rcmaehl]

37 minutes ago, JockoDundee said:

Are you looking to detect a particular process that you know the name of, or every new proccess?

How quick is quick?

Have you no delay in your ProcessExists loop currently?

Ideally a new process that I know the name of but whatever but even just for every new process would probably be an improvement over a ProcessExists() loop. Ideally the quicker the better without a constant CPU usage (a ProcessExist loop uses 5-10% CPU constantly on my system).

The issue I'm experiencing is that if Microsoft Edge is already open and you run microsoft-edge:https://google.com you only have a small period of time before the command line parameters containing the URI are lost. (Checkable using Get-WmiObject Win32_Process -Filter "name = 'msedge.exe'" | Select-Object CommandLine | Format-Table -Wrap -AutoSize | Out-File ./edge.txt in powershell) This doesn't occur with new Microsoft Edge windows, just ones Edge converts from a potential new window to a tab.

 

Edited November 13, 2021 by rcmaehl

[jguinch]

Look at this one :

 

[rcmaehl]

6 hours ago, jguinch said:

Look at this one :

 

WM_SHELLHOOK didn't work for me as the process had been running for a bit before it even created the window
 

IRONICALLY, Running ProcessExists ~140 times a second is SIGNIFICANTLY more lightweight than polling WMI 100 times a second.

Edited November 14, 2021 by rcmaehl

[Werty]

Does it have to poll that often? in Kylomas WMI example the interval is set at 0.1, have you tried fiddling with it, maybe 2.0?

 

Also, I dont know if it applies to this, but trancexx suggested to someone about using "volatile" together with an _On ObjEvent, in this thread.

https://www.autoitscript.com/forum/topic/199074-objevent-issue/?tab=comments#comment-1428487