Solved

FileSnoop

Posted on 1998-10-05
8
258 Views
Last Modified: 2010-04-01
I have MS VC++ 5.0 & I am trying to write a "FileSnoop" program which records system file accesses such as Open, Read, Write, etc.  I have looked at FileMon and it's very elegant, but how can I do it without using a vxd?
0
Comment
Question by:chrisrobinson
8 Comments
 

Author Comment

by:chrisrobinson
ID: 1174457
Edited text of question
0
 
LVL 1

Expert Comment

by:Booth882
ID: 1174458
I am sorry unrelated question but is this the chris robinson from tacoma WA?
0
 
LVL 8

Expert Comment

by:Answers2000
ID: 1174459
Without writing vXD : See

* FindFirstChangeNotification
* FindNextChangeNotification
* FindCloseChangeNotification
0
Gigs: Get Your Project Delivered by an Expert

Select from freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely and get projects done right.

 
LVL 4

Expert Comment

by:agreen
ID: 1174460
To receive ALL the file access events you need to write a device driver. For the sample driver look at the FileMon utility by Mark Russinovich.

For Windows NT: http://www.sysinternals.com/ntfilmon.htm
For Windows 95: http://www.sysinternals.com/filemon.htm
0
 

Author Comment

by:chrisrobinson
ID: 1174461
I don't see how a FindFirstChangeNotification, for example, would catch a file open or read.

Also, how do I answer Booth882 - I can't find his email address.

0
 
LVL 8

Expert Comment

by:Answers2000
ID: 1174462
To Ans Booth882 by Posting a comment

e-mail addresses not available from Ex-Ex unless Booth882 tells you in his own comment

FindxxxChangeNotification only pick up _changes_ to the file system, this is limitation of these functions
0
 
LVL 86

Accepted Solution

by:
jkr earned 50 total points
ID: 1174463
There are indeed two (hard) ways to do that:

1.) If you want to monitor certain programs, attach a DLL to them and patch the exe's import tables so that instead of the original kernel32.dll functions ('CreateFile()', 'ReadFile()' etc.) your own functions are called first, record the information and foward the call to the original function then.
(see "Load Your 32-bit DLL into Another Process's Address Space Using INJLIB" (Microsoft Systems Journal 5, May 1994) on how to do that)

2.) If you want to monitor _all_ file system activities, replace kernel32.dll with your own surrogate that logs all file system funcion calls before fowarding them to the original kernel32.dll (weel, i admit that this is a LOT of work, as this DLL contains approximately 680 functions...)
0
 

Author Comment

by:chrisrobinson
ID: 1174464
Thanks for the info.  I guess the VxD solution is best after all!
Now I must get the Windows 98 DDK.

For Booth882:  No I'm not from Tacoma, WA - I'm from Maidenhead, Berkshire, England.

0

Featured Post

Live: Real-Time Solutions, Start Here

Receive instant 1:1 support from technology experts, using our real-time conversation and whiteboard interface. Your first 5 minutes are always free.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When writing generic code, using template meta-programming techniques, it is sometimes useful to know if a type is convertible to another type. A good example of when this might be is if you are writing diagnostic instrumentation for code to generat…
In days of old, returning something by value from a function in C++ was necessarily avoided because it would, invariably, involve one or even two copies of the object being created and potentially costly calls to a copy-constructor and destructor. A…
The viewer will learn how to pass data into a function in C++. This is one step further in using functions. Instead of only printing text onto the console, the function will be able to perform calculations with argumentents given by the user.
The viewer will be introduced to the member functions push_back and pop_back of the vector class. The video will teach the difference between the two as well as how to use each one along with its functionality.

776 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question