Solved

FileSnoop

Posted on 1998-10-05
8
249 Views
Last Modified: 2010-04-01
I have MS VC++ 5.0 & I am trying to write a "FileSnoop" program which records system file accesses such as Open, Read, Write, etc.  I have looked at FileMon and it's very elegant, but how can I do it without using a vxd?
0
Comment
Question by:chrisrobinson
8 Comments
 

Author Comment

by:chrisrobinson
ID: 1174457
Edited text of question
0
 
LVL 1

Expert Comment

by:Booth882
ID: 1174458
I am sorry unrelated question but is this the chris robinson from tacoma WA?
0
 
LVL 8

Expert Comment

by:Answers2000
ID: 1174459
Without writing vXD : See

* FindFirstChangeNotification
* FindNextChangeNotification
* FindCloseChangeNotification
0
 
LVL 4

Expert Comment

by:agreen
ID: 1174460
To receive ALL the file access events you need to write a device driver. For the sample driver look at the FileMon utility by Mark Russinovich.

For Windows NT: http://www.sysinternals.com/ntfilmon.htm
For Windows 95: http://www.sysinternals.com/filemon.htm
0
Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

 

Author Comment

by:chrisrobinson
ID: 1174461
I don't see how a FindFirstChangeNotification, for example, would catch a file open or read.

Also, how do I answer Booth882 - I can't find his email address.

0
 
LVL 8

Expert Comment

by:Answers2000
ID: 1174462
To Ans Booth882 by Posting a comment

e-mail addresses not available from Ex-Ex unless Booth882 tells you in his own comment

FindxxxChangeNotification only pick up _changes_ to the file system, this is limitation of these functions
0
 
LVL 86

Accepted Solution

by:
jkr earned 50 total points
ID: 1174463
There are indeed two (hard) ways to do that:

1.) If you want to monitor certain programs, attach a DLL to them and patch the exe's import tables so that instead of the original kernel32.dll functions ('CreateFile()', 'ReadFile()' etc.) your own functions are called first, record the information and foward the call to the original function then.
(see "Load Your 32-bit DLL into Another Process's Address Space Using INJLIB" (Microsoft Systems Journal 5, May 1994) on how to do that)

2.) If you want to monitor _all_ file system activities, replace kernel32.dll with your own surrogate that logs all file system funcion calls before fowarding them to the original kernel32.dll (weel, i admit that this is a LOT of work, as this DLL contains approximately 680 functions...)
0
 

Author Comment

by:chrisrobinson
ID: 1174464
Thanks for the info.  I guess the VxD solution is best after all!
Now I must get the Windows 98 DDK.

For Booth882:  No I'm not from Tacoma, WA - I'm from Maidenhead, Berkshire, England.

0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

What is C++ STL?: STL stands for Standard Template Library and is a part of standard C++ libraries. It contains many useful data structures (containers) and algorithms, which can spare you a lot of the time. Today we will look at the STL Vector. …
Go is an acronym of golang, is a programming language developed Google in 2007. Go is a new language that is mostly in the C family, with significant input from Pascal/Modula/Oberon family. Hence Go arisen as low-level language with fast compilation…
The goal of the video will be to teach the user the concept of local variables and scope. An example of a locally defined variable will be given as well as an explanation of what scope is in C++. The local variable and concept of scope will be relat…
The goal of the video will be to teach the user the difference and consequence of passing data by value vs passing data by reference in C++. An example of passing data by value as well as an example of passing data by reference will be be given. Bot…

867 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now