Solved

Detecting and preventing writing certain files (i.e .doc) to the hdd using c++.

Posted on 2007-03-22
6
181 Views
Last Modified: 2013-11-22
I am writing an application using c++ and I have 2 questions.
a. How can I get a notification that a user is trying to write a file to the hard drive (any file and a specific file extension) ?
b. After detecting an attempt to write the file to the disk how can I prevent the operation ?
thanks.
0
Comment
Question by:iddo_shoham
6 Comments
 
LVL 53

Expert Comment

by:Infinity08
Comment Utility
This is certainly not a trivial thing to do.

First of all, what operating system are we talking about ?

Why do you want to use it ? There might be a better way to achieve what you want.

Usually, you can write-protect drives, directories, files for certain users. Is that sufficient ?
0
 
LVL 39

Expert Comment

by:itsmeandnobodyelse
Comment Utility
>>>> any file and a specific file extension
Your approach will not work even if you get the wished notification. The problem is that when renaming a file you won't get a notification cause it is a change of the directory rather than a change of the file. Also moving a file from one directory to another will give no write action if the directroies were located at the same disk.

If it really makes sense to prevent people from creating files of a specific type, you should remove the programs where they can store such files or give them read-only access for all folders where they shouldn't write to.

Regards, Alex
0
 
LVL 25

Expert Comment

by:kode99
Comment Utility
In order to do this sort of thing you will need to 'hook' into windows itself.  What this does is provide a notification which executes a callback function,  this is the 'hooked' into the OS.  So every time the OS performs a certain task your callback function will be executed.  It's kind of like writing a custom event to override a default event for a program,  except you can override windows API calls at a low level.

This is tricky business and you may need to filter through a lot of OS events to find the specific ones you want to prevent.  This can lead to performance penalties etc.

Here is a link to a toolkit for C++ and Delphi which can simplify the coding required,

http://www.madshi.net/madCodeHookDescription.htm

Also there is form and some good information about code hooking techniques,

http://help.madshi.net/madCodeHook.htm

0
Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

 
LVL 22

Expert Comment

by:grg99
Comment Utility
It's not too hard to do, Windows provides API's for hooking file and directory operations.

That is, if the user is "friendly".  The security system in Windows makes it all too easy for a user to find these hooks and undo them.

0
 

Author Comment

by:iddo_shoham
Comment Utility
Thanks for all of your replies.
Infinity08: the operating system is WinXp, I am writing an application that should be able to allow the administrator to prevent not admin users from saving certain file types to the hdd .
Kode99: thanks for the interesting links, can you point me to the direction to override windows API calls at a low level without using the toolkit?.
grg99: can you please elaborate, what API should I use, can you post some example code .
0
 
LVL 25

Accepted Solution

by:
kode99 earned 500 total points
Comment Utility
MS's documentation,

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/winui/winui/windowsuserinterface/windowing/hooks.asp

Decent article that steps through it,

http://www.devsource.com/article2/0,1895,1969408,00.asp

The madshi site also contains some useful general information about hooking.

There are a crap load of hooking SDK's around but many are just a framework for the win hooking api.
0

Featured Post

Find Ransomware Secrets With All-Source Analysis

Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

Join & Write a Comment

Suggested Solutions

HOW TO REMOTELY CLEAN MEROND.O WITH ESET SILENTLY PROBLEM       If you have the fortunate luck to contract the Merond.O virus on your network, it can be quite troublesome to remove as it propagates to network shares on your network. In my case, the …
The Samsung SSD 840 EVO and 840 EVO mSATA have a well-known problem with a drop in read performance. I first learned about this in an interesting thread here at Experts Exchange: http://www.experts-exchange.com/Hardware/Storage/Hard_Drives/Q_2852…
The viewer will learn how to clear a vector as well as how to detect empty vectors in C++.
The viewer will be introduced to the member functions push_back and pop_back of the vector class. The video will teach the difference between the two as well as how to use each one along with its functionality.

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now