For a small project that I'm working on, I need to prevent ".exe" files from running and know the path of the file that was trying to run. Maybe windows API hooking can help me, but I am unsure, and I haven't worked with it.

Can anyone guide me about how I can do it, possibly with API hooking?

CodePudding user response：

Hooking in usermode is going to be unreliable, to really do this you should write a driver and use PsSetCreateProcessNotifyRoutine.

If you only want "safe" applications, use Windows S-mode.

If you want to do this without writing code, use AppLocker.