Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 285
  • Last Modified:

FileSnoop

I have MS VC++ 5.0 & I am trying to write a "FileSnoop" program which records system file accesses such as Open, Read, Write, etc.  I have looked at FileMon and it's very elegant, but how can I do it without using a vxd?
0
chrisrobinson
Asked:
chrisrobinson
1 Solution
 
chrisrobinsonAuthor Commented:
Edited text of question
0
 
Booth882Commented:
I am sorry unrelated question but is this the chris robinson from tacoma WA?
0
 
Answers2000Commented:
Without writing vXD : See

* FindFirstChangeNotification
* FindNextChangeNotification
* FindCloseChangeNotification
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
agreenCommented:
To receive ALL the file access events you need to write a device driver. For the sample driver look at the FileMon utility by Mark Russinovich.

For Windows NT: http://www.sysinternals.com/ntfilmon.htm
For Windows 95: http://www.sysinternals.com/filemon.htm
0
 
chrisrobinsonAuthor Commented:
I don't see how a FindFirstChangeNotification, for example, would catch a file open or read.

Also, how do I answer Booth882 - I can't find his email address.

0
 
Answers2000Commented:
To Ans Booth882 by Posting a comment

e-mail addresses not available from Ex-Ex unless Booth882 tells you in his own comment

FindxxxChangeNotification only pick up _changes_ to the file system, this is limitation of these functions
0
 
jkrCommented:
There are indeed two (hard) ways to do that:

1.) If you want to monitor certain programs, attach a DLL to them and patch the exe's import tables so that instead of the original kernel32.dll functions ('CreateFile()', 'ReadFile()' etc.) your own functions are called first, record the information and foward the call to the original function then.
(see "Load Your 32-bit DLL into Another Process's Address Space Using INJLIB" (Microsoft Systems Journal 5, May 1994) on how to do that)

2.) If you want to monitor _all_ file system activities, replace kernel32.dll with your own surrogate that logs all file system funcion calls before fowarding them to the original kernel32.dll (weel, i admit that this is a LOT of work, as this DLL contains approximately 680 functions...)
0
 
chrisrobinsonAuthor Commented:
Thanks for the info.  I guess the VxD solution is best after all!
Now I must get the Windows 98 DDK.

For Booth882:  No I'm not from Tacoma, WA - I'm from Maidenhead, Berkshire, England.

0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now