Çözüldü Windows Gezgini üzerinde tıklanan programların gerçek zamanlı olarak dosya yolunu edinme

import os
import psutil
import time

def find_processes_opening_files(folder_path):
    processes = []
    for process in psutil.process_iter(['pid', 'name']):
        try:
            open_files = process.open_files()
            for file in open_files:
                if folder_path.lower() in file.path.lower():
                    processes.append({
                        'pid': process.info['pid'],
                        'name': process.info['name'],
                        'file_path': file.path,
                    })
        except (psutil.AccessDenied, psutil.NoSuchProcess, psutil.ZombieProcess):
            pass
    return processes

if __name__ == "__main__":
    target_folder_path = r'C:\Users'

    print(f"Monitoring for processes opening files in the {target_folder_path} directory")

    try:
        while True:
            processes = find_processes_opening_files(target_folder_path)
            if processes:
                print("Processes opening files:")
                for proc in processes:
                    print(f"- PID: {proc['pid']}, Name: {proc['name']}, File Path: {proc['file_path']}")
            else:
                print("No processes opening files.")
            time.sleep(1)
    except KeyboardInterrupt:
        pass

import psutil
import time
import json
from notifypy import Notify

NEW_PROCESSES_FILE = "new_processes.json"

def load_new_processes():
    try:
        with open(NEW_PROCESSES_FILE, "r") as file:
            return json.load(file)
    except (FileNotFoundError, json.JSONDecodeError):
        return []

def save_new_processes(new_processes):
    with open(NEW_PROCESSES_FILE, "w") as file:
        json.dump(new_processes, file)

def get_running_processes():
    return set((p.info['name'], p.info['exe']) for p in psutil.process_iter(['name', 'exe']))

def send_notification(title, message):
    notification = Notify()
    notification.title = title
    notification.message = message
    notification.send()

def main_program():
    previous_list = set()
    new_processes = load_new_processes()

    while True:
        # Get current running processes
        current_list = get_running_processes()

        # Compare with the previous list and find new processes
        newly_started_processes = current_list - previous_list
        new_processes.extend(newly_started_processes)

        if newly_started_processes:
            message = "\n".join([f"Path: {exe}" for name, exe in newly_started_processes])
            print("Newly started processes:", newly_started_processes)
            send_notification("New Processes", message)

        # Update the previous list
        previous_list = current_list

        # Save the updated new processes list to the file
        save_new_processes(new_processes)

        # Wait for a short period before checking again
        time.sleep(0.1)

if __name__ == "__main__":
    # Print the initially running processes
    print("Initially running processes:")
    print(get_running_processes())

    # Run the main program
    main_program()

import os
import psutil
import time
import json
from notifypy import Notify
import win32evtlog
import win32security

CONFIG_FOLDER = "config"
NEW_PROCESSES_FILE = os.path.join(CONFIG_FOLDER, "new_processes.json")

# Ensure the config folder exists
if not os.path.exists(CONFIG_FOLDER):
    os.makedirs(CONFIG_FOLDER)

def load_new_processes():
    try:
        with open(NEW_PROCESSES_FILE, "r") as file:
            return json.load(file)
    except (FileNotFoundError, json.JSONDecodeError):
        return []

def save_new_processes(new_processes):
    with open(NEW_PROCESSES_FILE, "w") as file:
        json.dump(new_processes, file)

def get_running_processes():
    return set((p.info['name'], p.info['exe'], p.pid, p.ppid()) for p in psutil.process_iter(['name', 'exe', 'pid', 'ppid']))

def get_parent_process_info(pid):
    try:
        parent_pid = psutil.Process(pid).ppid()
        parent_process = psutil.Process(parent_pid)
        return {
            'name': parent_process.name(),
            'exe': parent_process.exe(),
            'pid': parent_process.pid,
        }
    except (psutil.NoSuchProcess, psutil.AccessDenied) as e:
        print(f"Error getting parent process info for PID {pid}: {e}")
        return None
    except Exception as e:
        print(f"An unexpected error occurred while getting parent process info: {e}")
        return None

def get_user_from_event_log(process_name):
    try:
        # Open the Security event log
        handle = win32evtlog.OpenEventLog(None, "Security")

        # Set the starting record to the end of the log
        flags = win32evtlog.EVENTLOG_BACKWARDS_READ | win32evtlog.EVENTLOG_SEQUENTIAL_READ
        total_records = win32evtlog.GetNumberOfEventLogRecords(handle)
        starting_record = total_records

        while True:
            # Read a batch of records
            events = win32evtlog.ReadEventLog(handle, flags, starting_record)

            if not events:
                break

            for event in events:
                # Check if the event is a process creation event (Event ID 4688)
                if event.EventID == 4688:
                    data = event.StringInserts

                    # Check if the process name matches the target process
                    if process_name.lower() in data[5].lower():
                        # Get the security identifier (SID) of the user
                        user_sid = data[1]

                        # Convert the SID to a username
                        username, _, _ = win32security.LookupAccountSid(None, win32security.GetBinarySid(user_sid))

                        return username

            # Update the starting record for the next batch
            starting_record -= len(events)

        # Close the event log handle
        win32evtlog.CloseEventLog(handle)
    except Exception as e:
        print(f"Error retrieving username from event log: {e}")
        return "Unknown"

def send_notification(title, message):
    notification = Notify()
    notification.title = title
    notification.message = message
    notification.send()

def main_program():
    previous_list = set()
    new_processes = load_new_processes()
    printed_processes = set()

    while True:
        # Get current running processes
        current_list = get_running_processes()

        # Compare with the previous list and find new processes
        newly_started_processes = current_list - previous_list
        new_processes.extend(newly_started_processes)

        if newly_started_processes:
            messages = []
            for name, exe, pid, parent_pid in newly_started_processes:
                if exe not in printed_processes:
                    # Print the running file only once
                    print(f"Running File: {exe}")
                    printed_processes.add(exe)

                parent_process_info = get_parent_process_info(pid)
                if parent_process_info is None:
                    continue  # Skip printing if parent process info is None

                parent_path = parent_process_info['exe']

                # Check if parent and child have the same location
                if parent_path != "Unknown" and exe.startswith(parent_path):
                    continue  # Skip printing if they have the same location

                # Check if parent and child have the same full path
                if os.path.abspath(exe) == os.path.abspath(parent_path):
                    continue  # Skip printing if they have the same full path

                # Retrieve the username from Windows logs
                user = get_user_from_event_log(exe)

                messages.append(f"Path: {exe}, Parent Process Path: {parent_path}, User: {user}")

                # Send notification
                send_notification("New Process Detected", f"Path: {exe}, Parent Process Path: {parent_path}, User: {user}")

            console_output = "\n".join(messages)
            print("Console Output:", console_output)

        # Update the previous list
        previous_list = current_list

        # Save the updated new processes list to the file
        save_new_processes(new_processes)

        # Wait for a short period before checking again
        time.sleep(0.1)

if __name__ == "__main__":
    # Print the initially running processes
    print("Initially running processes:")
    print(get_running_processes())

    # Run the main program
    main_program()

import os
import psutil
import time
import json
from notifypy import Notify
import win32evtlog
import win32security

CONFIG_FOLDER = "config"
NEW_PROCESSES_FILE = os.path.join(CONFIG_FOLDER, "new_processes.json")

# Ensure the config folder exists
if not os.path.exists(CONFIG_FOLDER):
    os.makedirs(CONFIG_FOLDER)

def load_new_processes():
    try:
        with open(NEW_PROCESSES_FILE, "r") as file:
            return json.load(file)
    except (FileNotFoundError, json.JSONDecodeError):
        return []

def save_new_processes(new_processes):
    with open(NEW_PROCESSES_FILE, "w") as file:
        json.dump(new_processes, file)
        
def get_running_processes():
    processes = set()
    for p in psutil.process_iter(['name', 'exe', 'cmdline', 'pid', 'ppid']):
        try:
            if p.info is not None and 'name' in p.info and 'exe' in p.info:
                name = p.info['name']
                exe = p.info['exe']
                cmdline = tuple(p.info.get('cmdline', []))
                pid = p.pid
                ppid = p.ppid()
                processes.add((name, exe, cmdline, pid, ppid))
        except (psutil.NoSuchProcess, psutil.AccessDenied, psutil.ZombieProcess):
            pass  # Skip processes that are inaccessible or no longer exist
        except Exception as e:
            print(f"Error getting process info: {e}")
    return processes

def get_parent_process_info(pid):
    try:
        parent_pid = psutil.Process(pid).ppid()
        parent_process = psutil.Process(parent_pid)
        return {
            'name': parent_process.name(),
            'exe': parent_process.exe(),
            'cmdline': parent_process.cmdline(),
            'pid': parent_process.pid,
        }
    except (psutil.NoSuchProcess, psutil.AccessDenied) as e:
        print(f"Error getting parent process info for PID {pid}: {e}")
        return None
    except Exception as e:
        print(f"An unexpected error occurred while getting parent process info: {e}")
        return None

def get_user_from_event_log(process_name):
    try:
        # Open the Security event log
        handle = win32evtlog.OpenEventLog(None, "Security")

        # Set the starting record to the end of the log
        flags = win32evtlog.EVENTLOG_BACKWARDS_READ | win32evtlog.EVENTLOG_SEQUENTIAL_READ
        total_records = win32evtlog.GetNumberOfEventLogRecords(handle)
        starting_record = total_records

        while True:
            # Read a batch of records
            events = win32evtlog.ReadEventLog(handle, flags, starting_record)

            if not events:
                break

            for event in events:
                # Check if the event is a process creation event (Event ID 4688)
                if event.EventID == 4688:
                    data = event.StringInserts

                    # Check if the process name matches the target process
                    if process_name.lower() in data[5].lower():
                        return "Unknown"

            # Update the starting record for the next batch
            starting_record -= len(events)

        # Close the event log handle
        win32evtlog.CloseEventLog(handle)
    except Exception as e:
        print(f"Error retrieving username from event log: {e}")
        return "Unknown"

def send_notification(title, message):
    notification = Notify()
    notification.title = title
    notification.message = message
    notification.send()

def main_program():
    previous_list = set()
    new_processes = load_new_processes()
    printed_processes = set()

    while True:
        # Get current running processes
        current_list = get_running_processes()

        # Compare with the previous list and find new processes
        newly_started_processes = current_list - previous_list
        new_processes.extend(newly_started_processes)

        if newly_started_processes:
            messages = []
            for name, exe, cmdline, pid, parent_pid in newly_started_processes:
                if exe not in printed_processes:
                    # Print the running file only once
                    print(f"Running File: {exe}")
                    printed_processes.add(exe)

                parent_process_info = get_parent_process_info(pid)
                if parent_process_info is None:
                    continue  # Skip printing if parent process info is None

                parent_path = parent_process_info['exe']

                # Check if parent and child have the same location
                if parent_path != "Unknown" and exe.startswith(parent_path):
                    continue  # Skip printing if they have the same location

                # Check if parent and child have the same full path
                if os.path.abspath(exe) == os.path.abspath(parent_path):
                    continue  # Skip printing if they have the same full path

                # Retrieve the username from Windows logs
                user = get_user_from_event_log(exe)

                message = f"Path: {exe}, Parent Process Path: {parent_path}, Command Line: {cmdline}"

                # Print to the console
                print("New Process Detected:", message)

                messages.append(message)

            # Send notification
            if messages:
                console_output = "\n".join(messages)
                send_notification("New Process Detected", console_output)

        # Update the previous list
        previous_list = current_list

        # Save the updated new processes list to the file
        save_new_processes(new_processes)

        # Wait for a short period before checking again
        time.sleep(0.1)

if __name__ == "__main__":
    # Print the initially running processes
    print("Initially running processes:")
    print(get_running_processes())

    # Run the main program
    main_program()

import os
import psutil
import time
import json
from notifypy import Notify
import win32evtlog
import concurrent.futures

CONFIG_FOLDER = "config"
NEW_PROCESSES_FILE = os.path.join(CONFIG_FOLDER, "new_processes.json")

# Ensure the config folder exists
if not os.path.exists(CONFIG_FOLDER):
    os.makedirs(CONFIG_FOLDER)

def load_new_processes():
    try:
        with open(NEW_PROCESSES_FILE, "r") as file:
            return json.load(file)
    except (FileNotFoundError, json.JSONDecodeError):
        return []

def save_new_processes(new_processes):
    with open(NEW_PROCESSES_FILE, "w") as file:
        json.dump(new_processes, file)

def get_running_processes():
    processes = set()
    for p in psutil.process_iter(['name', 'exe', 'cmdline', 'pid', 'ppid']):
        try:
            if p.info is not None and 'name' in p.info and 'exe' in p.info:
                name = p.info['name']
                exe = p.info['exe']
                cmdline = tuple(p.info.get('cmdline', []))
                pid = p.pid
                ppid = p.ppid()
                processes.add((name, exe, cmdline, pid, ppid))
        except (psutil.NoSuchProcess, psutil.AccessDenied, psutil.ZombieProcess):
            pass  # Skip processes that are inaccessible or no longer exist
        except Exception as e:
            print(f"Error getting process info: {e}")
    return processes

def get_parent_process_info(pid):
    try:
        parent_pid = psutil.Process(pid).ppid()
        parent_process = psutil.Process(parent_pid)
        return {
            'name': parent_process.name(),
            'exe': parent_process.exe(),
            'cmdline': parent_process.cmdline(),
            'pid': parent_process.pid,
        }
    except (psutil.NoSuchProcess, psutil.AccessDenied) as e:
        pass
    except Exception as e:
        print(f"An unexpected error occurred while getting parent process info: {e}")
        return None

def get_user_from_event_log(process_name):
    try:
        # Open the Security event log
        handle = win32evtlog.OpenEventLog(None, "Security")

        # Set the starting record to the end of the log
        flags = win32evtlog.EVENTLOG_BACKWARDS_READ | win32evtlog.EVENTLOG_SEQUENTIAL_READ
        total_records = win32evtlog.GetNumberOfEventLogRecords(handle)
        starting_record = total_records

        while True:
            # Read a batch of records
            events = win32evtlog.ReadEventLog(handle, flags, starting_record)

            if not events:
                break

            for event in events:
                # Check if the event is a process creation event (Event ID 4688)
                if event.EventID == 4688:
                    data = event.StringInserts

                    # Check if the process name matches the target process
                    if process_name.lower() in data[5].lower():
                        return "Unknown"

            # Update the starting record for the next batch
            starting_record -= len(events)

        # Close the event log handle
        win32evtlog.CloseEventLog(handle)
    except Exception as e:
        print(f"Error retrieving username from event log: {e}")
        return "Unknown"

def send_notification(title, message):
    notification = Notify()
    notification.title = title
    notification.message = message
    notification.send()

def process_checker(process_info, printed_processes):
    name, exe, cmdline, pid, parent_pid = process_info

    if exe not in printed_processes:
        # Print the running file only once
        print(f"Running File: {exe}")
        printed_processes.add(exe)

    parent_process_info = get_parent_process_info(pid)
    if parent_process_info is None or parent_process_info.get('exe') is None:
        return  # Skip processing if parent process info is None or has no executable information

    parent_path = parent_process_info['exe']

    # Check if parent and child have the same location
    if parent_path != "Unknown" and exe.startswith(parent_path):
        return  # Skip processing if they have the same location

    # Check if parent and child have the same full path
    if os.path.abspath(exe) == os.path.abspath(parent_path):
        return  # Skip processing if they have the same full path

    # Retrieve the username from Windows logs
    user = get_user_from_event_log(exe)

    message = f"Path: {exe}, Parent Process Path: {parent_path}, Command Line: {cmdline}"

    # Print to the console
    print("New Process Detected:", message)

    # Send notification
    send_notification("New Process Detected", message)

def main_program():
    previous_list = set()
    new_processes = load_new_processes()
    printed_processes = set()

    while True:
        # Get current running processes
        current_list = get_running_processes()

        # Compare with the previous list and find new processes
        newly_started_processes = current_list - previous_list
        new_processes.extend(newly_started_processes)

        if newly_started_processes:
            with concurrent.futures.ThreadPoolExecutor() as executor:
                executor.map(lambda info: process_checker(info, printed_processes), newly_started_processes)

        # Update the previous list
        previous_list = current_list

        # Save the updated new processes list to the file
        save_new_processes(new_processes)

        # Wait for a short period before checking again
        time.sleep(0.1)

if __name__ == "__main__":
    # Print the initially running processes
    print("Initially running processes:")
    print(get_running_processes())

    # Run the main program
    main_program()