Solved

FileSnoop

Posted on 1998-10-05
8
237 Views
Last Modified: 2010-04-01
I have MS VC++ 5.0 & I am trying to write a "FileSnoop" program which records system file accesses such as Open, Read, Write, etc.  I have looked at FileMon and it's very elegant, but how can I do it without using a vxd?
0
Comment
Question by:chrisrobinson
8 Comments
 

Author Comment

by:chrisrobinson
ID: 1174457
Edited text of question
0
 
LVL 1

Expert Comment

by:Booth882
ID: 1174458
I am sorry unrelated question but is this the chris robinson from tacoma WA?
0
 
LVL 8

Expert Comment

by:Answers2000
ID: 1174459
Without writing vXD : See

* FindFirstChangeNotification
* FindNextChangeNotification
* FindCloseChangeNotification
0
 
LVL 4

Expert Comment

by:agreen
ID: 1174460
To receive ALL the file access events you need to write a device driver. For the sample driver look at the FileMon utility by Mark Russinovich.

For Windows NT: http://www.sysinternals.com/ntfilmon.htm
For Windows 95: http://www.sysinternals.com/filemon.htm
0
Highfive + Dolby Voice = No More Audio Complaints!

Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

 

Author Comment

by:chrisrobinson
ID: 1174461
I don't see how a FindFirstChangeNotification, for example, would catch a file open or read.

Also, how do I answer Booth882 - I can't find his email address.

0
 
LVL 8

Expert Comment

by:Answers2000
ID: 1174462
To Ans Booth882 by Posting a comment

e-mail addresses not available from Ex-Ex unless Booth882 tells you in his own comment

FindxxxChangeNotification only pick up _changes_ to the file system, this is limitation of these functions
0
 
LVL 86

Accepted Solution

by:
jkr earned 50 total points
ID: 1174463
There are indeed two (hard) ways to do that:

1.) If you want to monitor certain programs, attach a DLL to them and patch the exe's import tables so that instead of the original kernel32.dll functions ('CreateFile()', 'ReadFile()' etc.) your own functions are called first, record the information and foward the call to the original function then.
(see "Load Your 32-bit DLL into Another Process's Address Space Using INJLIB" (Microsoft Systems Journal 5, May 1994) on how to do that)

2.) If you want to monitor _all_ file system activities, replace kernel32.dll with your own surrogate that logs all file system funcion calls before fowarding them to the original kernel32.dll (weel, i admit that this is a LOT of work, as this DLL contains approximately 680 functions...)
0
 

Author Comment

by:chrisrobinson
ID: 1174464
Thanks for the info.  I guess the VxD solution is best after all!
Now I must get the Windows 98 DDK.

For Booth882:  No I'm not from Tacoma, WA - I'm from Maidenhead, Berkshire, England.

0

Featured Post

What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

Suggested Solutions

In days of old, returning something by value from a function in C++ was necessarily avoided because it would, invariably, involve one or even two copies of the object being created and potentially costly calls to a copy-constructor and destructor. A…
This article will show you some of the more useful Standard Template Library (STL) algorithms through the use of working examples.  You will learn about how these algorithms fit into the STL architecture, how they work with STL containers, and why t…
The goal of the tutorial is to teach the user how to use functions in C++. The video will cover how to define functions, how to call functions and how to create functions prototypes. Microsoft Visual C++ 2010 Express will be used as a text editor an…
The goal of the video will be to teach the user the concept of local variables and scope. An example of a locally defined variable will be given as well as an explanation of what scope is in C++. The local variable and concept of scope will be relat…

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now