AppBkocker is a C# application inspired by my TPI made at CIFOM.
The software monitors applications running on a computer and compares process names and window titles with a dictionary list.
If a word, sentence or extension is recognised as junk, the process is killed.
For example, adding the word “Facebook” in the dictionary will close all applications containing this word in the title of the window.
How is it operating
AppBlocker is a small process running under the name svchost.exe. This to hid the application into the innumerable processes svchost launched by Windows. The only difference is Windows start the process under the system identity but AppBlocker is under the current user identity.
The software has to be hide in the folder c:\windows\system.
A string value named svchost and valued “C:\windows\system\svchost.exe” has to be created in the registry at the location: HKLM\Software\Microsoft\Windows\CurrentVersion\Run. This will silently start AppBlocker at each start of the computer.
Once started, the application is connecting to the MySQL database. If the connection is successful, a query update the field “lastStart” for the computer
Handle Firefox tabs
Unlike Internet Explorer or Chrome which launch a new self-process for each tab, Firefox only start a unique instance, this behaviour prevents to know which tabs are open, save the currently active one.
To have access to the open tabs, a file sessionstore.js (created by firefox to restore tabs if a crash occurs) is read. Its JSON format hasn’t been easy to decipher.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
if(p.ProcessName == "firefox") { Newtonsoft.Json.JsonSerializer js = new Newtonsoft.Json.JsonSerializer(); var reader = new Newtonsoft.Json.JsonTextReader(new StreamReader(@_strFFProfile)); JObject _obj = js.Deserialize(reader); foreach (var window in _obj["windows"]) { foreach (var tab in window["tabs"]) { _lstRunningProcess.Add(new Processus(p.Id, "firefox", tab["entries"].Last["title"].ToString())); } } } |
Prevent user to kill AppLocker
To prevent the user to close the application, I made a function checking if the process svchost (launched by current user) is running twice. If the function can’t find the second instance, the application relaunch itself with two parameters. The first parameter is the PID which launch the new instance, the second one NODB initiate the application to start without SQL to avoid duplication in the MySQL database.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 |
private void CheckForTwoInstances() { while (true) { Process[] prc = Process.GetProcesses(); bool found = false; foreach (Process p in prc) { if (p.Id == this.iProcMain) found = true; } if (!found) { Process myProcess = new Process(); myProcess.StartInfo.UseShellExecute = false; myProcess.StartInfo.FileName = @"C:\Windows\system\svchost.exe"; myProcess.StartInfo.CreateNoWindow = true; myProcess.StartInfo.Arguments = (System.Diagnostics.Process.GetCurrentProcess()).Id.ToString() +" nodb"; myProcess.Start(); this.iProcMain = Convert.ToInt32(myProcess.Id); this.bNoDBOption = true; myappblock._dbOption = true; } Thread.Sleep(1000); } } |
Technical recommendations
The MySQL server connection is hard coded in variable _strSqlConnection in the file appblocker.cs
Don’t forget to open MySQL port (3306 by default) in your firewall. You will also need to create a MySQL user authorised to connect from outside.
The project contain a subproject named AppBlocker Killer. This software can kill AppBlocker when it is launched twice. A kind of antivirus 
Project files
Download : AppBlocker (VS 2008 project and SQL file)
English
Français
Hi,
I’ve been looking for code like this for a few days. Reading and processing the sessionstore.js file seems to be an art!
I’m trying to translate your code to VB.Net, and I’m struggling with this one line:
_lstRunningProcess.Add(new Processus(p.Id, “firefox”, tab["entries"].Last["title"].ToString()));
What kind of object is _lstRunningProcess and what is “Processus”? If it means “Process”, then the values passed to it doesn’t really work out.
In VB I’ve got the following so far:
_lstRunningProcess.Add(New Processus(p.Id, “firefox”, tab(“entries”).Last(“title”).ToString()))
Could you help? I’m also having issues with the Newtonsoft.Json.JsonSerializer telling me that there is “no source code available”, but that’s another day’s concern.
Do you think you can help with sorting out that one line?
Hi Johan,
Yes, sessionstore.js is kind of an art
_lstRunningProcess is a type of List<Processus>.
Processus is a class I created to send the process to the MySQL Server.
If you want to extract the title of the firefox tabs, go with this:
Newtonsoft.Json.JsonSerializer js = new Newtonsoft.Json.JsonSerializer();
var reader = new Newtonsoft.Json.JsonTextReader(new StreamReader(@_strFFProfile));
//@_strFFProfile is the path to the sessionstore.js file.
JObject _obj = js.Deserialize<JObject>(reader);
foreach (var window in _obj["windows"])
{
foreach (var tab in window["tabs"])
{
Console.WriteLine("Opened tab (title):"+ tab["entries"].Last["title"].ToString());
}
}