c++winapifile-monitoringapi-hook

Block .exe files


For a small project that I'm working on, I need to prevent ".exe" files from running and know the path of the file that was trying to run. Maybe windows API hooking can help me, but I am unsure, and I haven't worked with it.

Can anyone guide me about how I can do it, possibly with API hooking?


Solution

  • Hooking in usermode is going to be unreliable, to really do this you should write a driver and use PsSetCreateProcessNotifyRoutine.

    If you only want "safe" applications, use Windows S-mode.

    If you want to do this without writing code, use AppLocker.