Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

FileSnoop

Posted on 1998-10-05
8
Medium Priority
?
282 Views
Last Modified: 2010-04-01
I have MS VC++ 5.0 & I am trying to write a "FileSnoop" program which records system file accesses such as Open, Read, Write, etc.  I have looked at FileMon and it's very elegant, but how can I do it without using a vxd?
0
Comment
Question by:chrisrobinson
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
8 Comments
 

Author Comment

by:chrisrobinson
ID: 1174457
Edited text of question
0
 
LVL 1

Expert Comment

by:Booth882
ID: 1174458
I am sorry unrelated question but is this the chris robinson from tacoma WA?
0
 
LVL 8

Expert Comment

by:Answers2000
ID: 1174459
Without writing vXD : See

* FindFirstChangeNotification
* FindNextChangeNotification
* FindCloseChangeNotification
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 4

Expert Comment

by:agreen
ID: 1174460
To receive ALL the file access events you need to write a device driver. For the sample driver look at the FileMon utility by Mark Russinovich.

For Windows NT: http://www.sysinternals.com/ntfilmon.htm
For Windows 95: http://www.sysinternals.com/filemon.htm
0
 

Author Comment

by:chrisrobinson
ID: 1174461
I don't see how a FindFirstChangeNotification, for example, would catch a file open or read.

Also, how do I answer Booth882 - I can't find his email address.

0
 
LVL 8

Expert Comment

by:Answers2000
ID: 1174462
To Ans Booth882 by Posting a comment

e-mail addresses not available from Ex-Ex unless Booth882 tells you in his own comment

FindxxxChangeNotification only pick up _changes_ to the file system, this is limitation of these functions
0
 
LVL 86

Accepted Solution

by:
jkr earned 150 total points
ID: 1174463
There are indeed two (hard) ways to do that:

1.) If you want to monitor certain programs, attach a DLL to them and patch the exe's import tables so that instead of the original kernel32.dll functions ('CreateFile()', 'ReadFile()' etc.) your own functions are called first, record the information and foward the call to the original function then.
(see "Load Your 32-bit DLL into Another Process's Address Space Using INJLIB" (Microsoft Systems Journal 5, May 1994) on how to do that)

2.) If you want to monitor _all_ file system activities, replace kernel32.dll with your own surrogate that logs all file system funcion calls before fowarding them to the original kernel32.dll (weel, i admit that this is a LOT of work, as this DLL contains approximately 680 functions...)
0
 

Author Comment

by:chrisrobinson
ID: 1174464
Thanks for the info.  I guess the VxD solution is best after all!
Now I must get the Windows 98 DDK.

For Booth882:  No I'm not from Tacoma, WA - I'm from Maidenhead, Berkshire, England.

0

Featured Post

Important Lessons on Recovering from Petya

In their most recent webinar, Skyport Systems explores ways to isolate and protect critical databases to keep the core of your company safe from harm.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article will show you some of the more useful Standard Template Library (STL) algorithms through the use of working examples.  You will learn about how these algorithms fit into the STL architecture, how they work with STL containers, and why t…
Container Orchestration platforms empower organizations to scale their apps at an exceptional rate. This is the reason numerous innovation-driven companies are moving apps to an appropriated datacenter wide platform that empowers them to scale at a …
The goal of the video will be to teach the user the difference and consequence of passing data by value vs passing data by reference in C++. An example of passing data by value as well as an example of passing data by reference will be be given. Bot…
The viewer will learn additional member functions of the vector class. Specifically, the capacity and swap member functions will be introduced.

715 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question