C / C++ / MFC

Re: Windows File Access Monotoring

19-Jul-06 2:25

You need to intercept all the system services used to open files.
To do that you need a system hook, is more, you'll need a Kernel mode driver to install the hook.
Forget about C# and start learning WIN32 and Assembler.

What you try to do is really f***ing hard, I can tell you because I was working in a project similar to what you say.

Anton Basov articles would be really helpfull in your task, you can find them in the code project.

Hope this helps

sundar1562-Aug-06 11:01

sundar156

2-Aug-06 11:01

Thanks a lot for your reply.. Smile | :)

Luck is Opportunity with hardwork

hook [modified]

farshad.f18-Jul-06 7:47

farshad.f

18-Jul-06 7:47

hi i coded a hook dll,but when i wanna add a file and write the result i dont know what happens.my file is wrong or somtimes it's empty
(but messagebos shows the right result !!!!!!!)
here is my code:
#include "a.h"
#include <stdio.h>
#include <stdlib.h>
#include <psapi.h>
#include <string.h>
#include <winreg.h>
#include <process.h>
#include <windef.h>
#include <windows.h>
#include <io.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>

int x=0;

int stream;
FILE* fout;
static BOOL bHooked = FALSE;

static HHOOK CBT=0,CBT1=0;
static HINSTANCE hInst;
static int count;
char szModName[1024];
char szModName1[1024];

char nul[1024];

char win[1024];

void GetWinDir(void);

LRESULT CALLBACK CBTProc(int code, WPARAM wParam, LPARAM lParam);
//LRESULT CALLBACK CBTProc1(int code, WPARAM wParam, LPARAM lParam);

BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason, LPVOID lpvReserved)
{
switch (fdwReason)
{
case DLL_PROCESS_ATTACH:
hInst=hinstDLL;

count=0;
break;
case DLL_THREAD_ATTACH:
break;
case DLL_THREAD_DETACH:
break;
case DLL_PROCESS_DETACH:
break;
default:
break;
}

return TRUE;
}

DLL_EXPORT void BagaHooku(void)
{
if(!bHooked)
{
CBT = SetWindowsHookEx(WH_CBT, (HOOKPROC)CBTProc, hInst, (DWORD)NULL);
/// CBT1 = SetWindowsHookEx(WH_CBT, (HOOKPROC)CBTProc1, hInst, (DWORD)NULL);
bHooked = TRUE;
}
}

DLL_EXPORT void ScoateHooku(void)
{
if(bHooked)
{
UnhookWindowsHookEx(CBT);
// UnhookWindowsHookEx(CBT1);

}
}

LRESULT CALLBACK CBTProc(int nCode,WPARAM wParam,LPARAM lParam)

{
if ((nCode==HCBT_ACTIVATE)||(nCode==HCBT_SYSCOMMAND)||(nCode==HCBT_QS)||(nCode==HCBT_CREATEWND))

//if (nCode==HCBT_DESTROYWND)

{
//MessageBox (NULL, TEXT ("send processes"), TEXT ("HelloMsg"), 0) ;

HANDLE hProc;
HMODULE hMods[1024];
DWORD n;
DWORD dwProcessId ;
DWORD lpExitCode;
DWORD dwSize,dwType,dwDisp;
HKEY Regentry;
char *host1;
char host[1024];
char rezerva[1024];

//MessageBox (NULL, TEXT ("send processes"), TEXT ("HelloMsg"), 0) ;

GetWindowThreadProcessId((HWND)wParam, &dwProcessId);
hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, (DWORD)dwProcessId);

if(EnumProcessModules(hProc, hMods, sizeof(hMods), &n))
{
if (n>0)
GetModuleFileNameEx(hProc, hMods[0], szModName, sizeof(szModName));
}

GetExitCodeProcess(hProc,&lpExitCode);

if(!(host1=strrchr(szModName,'\\')))
strcpy(host,szModName);
else
strcpy(host,host1+1);

RegOpenKeyEx(HKEY_LOCAL_MACHINE, "SOFTWARE\\Gapula\\PEND", 0, KEY_QUERY_VALUE, &Regentry);
RegQueryValueEx(Regentry,host , NULL, &dwType, (unsigned char*)&rezerva, &dwSize);
if(RegQueryValueEx(Regentry,host , NULL, &dwType, (unsigned char*)&rezerva, &dwSize)!=ERROR_SUCCESS)
{
RegOpenKeyEx(HKEY_LOCAL_MACHINE, "SOFTWARE\\Gapula\\OK", 0, KEY_QUERY_VALUE, &Regentry);
RegQueryValueEx(Regentry,host , NULL, &dwType, (unsigned char*)&rezerva, &dwSize);

if(RegQueryValueEx(Regentry,host , NULL, &dwType, (unsigned char*)&rezerva, &dwSize)!=ERROR_SUCCESS)
{
RegCloseKey(Regentry);
RegOpenKeyEx(HKEY_LOCAL_MACHINE, "SOFTWARE\\Gapula\\RESTR", 0, KEY_QUERY_VALUE|KEY_ALL_ACCESS, &Regentry);
RegQueryValueEx(Regentry,host , NULL, &dwType, (unsigned char*)&rezerva, &dwSize);

if(RegQueryValueEx(Regentry,host , NULL, &dwType, (unsigned char*)&rezerva, &dwSize)!=ERROR_SUCCESS)
{
RegCreateKeyEx( HKEY_LOCAL_MACHINE, "SOFTWARE\\Gapula\\PEND", 0, "", REG_OPTION_NON_VOLATILE,KEY_WRITE, NULL, &Regentry, &dwDisp);
RegSetValueEx(Regentry, host, 0, REG_SZ,(unsigned char *)szModName, strlen(szModName)+1);
RegCloseKey(Regentry);
strcat(szModName," is trying to END, do you allow that ?\n Please recall that if you say yes this action will be happening every time this program starts\nThis goes for NO as well so be careful what you wish for");

//++++++++++++++++++++++++++++++++++++++++++++++
fout = fopen("out.txt", "a+");

fwrite(host, 1,strlen(host), fout);
// fwrite("\n",1,2,fout);
fclose(fout);
//++++++++++++++++++++++++++++++++++++++++++++++++++++

//this messagebox shows the right answer but the file above shows the wrong!!!!! whats problem?
MessageBox (NULL, host, TEXT ("HelloMsg"), 0) ;

if (MessageBox(NULL,szModName,"Gabby",MB_ICONQUESTION|MB_SYSTEMMODAL|MB_APPLMODAL|MB_TASKMODAL|MB_SETFOREGROUND|MB_TOPMOST|MB_YESNO)==IDNO)
{
RegCreateKeyEx( HKEY_LOCAL_MACHINE, "SOFTWARE\\Gapula\\RESTR", 0, "", REG_OPTION_NON_VOLATILE,KEY_WRITE, NULL, &Regentry, &dwDisp);
RegSetValueEx(Regentry, host, 0, REG_SZ,(unsigned char *)szModName, strlen(szModName)+1);
RegCloseKey(Regentry);

//MessageBox (NULL, TEXT ("send processes"), TEXT ("HelloMsg"), 0) ;
TerminateProcess(hProc, (UINT)lpExitCode);
}
else
{

RegCreateKeyEx( HKEY_LOCAL_MACHINE, "SOFTWARE\\Gapula\\OK", 0, "", REG_OPTION_NON_VOLATILE,KEY_WRITE, NULL, &Regentry, &dwDisp);
RegSetValueEx(Regentry, host, 0, REG_SZ,(unsigned char *)szModName, strlen(szModName)+1);
RegCloseKey(Regentry);
return 0;
}

}

else
//MessageBox (NULL, TEXT ("send processes"), TEXT ("HelloMsg"), 0) ;
TerminateProcess(hProc, (UINT)lpExitCode);

}

else

{
return 0;
}

}

else
{
RegOpenKeyEx(HKEY_LOCAL_MACHINE, "SOFTWARE\\Gapula\\RESTR", 0, KEY_QUERY_VALUE|KEY_ALL_ACCESS, &Regentry);
RegQueryValueEx(Regentry,host , NULL, &dwType, (unsigned char*)&rezerva, &dwSize);

if(RegQueryValueEx(Regentry,host , NULL, &dwType, (unsigned char*)&rezerva, &dwSize)!=ERROR_SUCCESS)

return 0;

else
//MessageBox (NULL, TEXT ("send processes"), TEXT ("HelloMsg"), 0) ;
TerminateProcess(hProc, (UINT)lpExitCode);
}

}

return CallNextHookEx(CBT,nCode,wParam,lParam);
}

this part is wrong:
fout = fopen("out.txt", "a+");

fwrite(host, 1,strlen(host), fout);
// fwrite("\n",1,2,fout);
fclose(fout);
???????????????????????????????

-- modified at 13:51 Tuesday 18th July, 2006

David Crow18-Jul-06 8:30

David Crow

18-Jul-06 8:30

You'd get a lot more help if you'd narrow this down to just a handful of lines. No one likes to wade through complete programs, or even several pages of code, to locate a problem. Try:

void main( void )
{
    char host[1024], szModName[1024], *host1; // initialize these accordingly
 
    if (! (host1 = strrchr(szModName, '\\')))
        strcpy(host, szModName);
    else
        strcpy(host, host1 + 1);
    
    FILE *fout = fopen("out.txt", "a+");
    fwrite(host, 1, strlen(host), fout);
    fclose(fout); 
}

Now step through each of these until you locate the offending statement.

"Money talks. When my money starts to talk, I get a bill to shut it up." - Frank

"Judge not by the eye but by the heart." - Native American Proverb

farshad.f18-Jul-06 19:51

farshad.f

18-Jul-06 19:51

thank u david

Ali Rafiee18-Jul-06 9:28

Ali Rafiee

18-Jul-06 9:28

are you sure you are looking at the correct out.txt file?

because this code looks fine: (isolated that is)
fout = fopen("out.txt", "a+");
fwrite(host, 1,strlen(host), fout);
fclose(fout);

Is this a Unicode project?

AliR.
Visual C++ MVP

farshad.f18-Jul-06 19:55

farshad.f

18-Jul-06 19:55

salam
are file ijad mishe.ama mohtaviyatesh gheire marbote.hamihe esme barnameye hoohamo minevise!
dar hali ke man mohtavaiyate hosto ba message box ke nehson midam doroste ama vaghti to iflemikhad benevise eshtebah darm miad.
to rahi dari ke ijade proceesaro elam kone
man enumprocess gozahstam ta prosseaye jari ro nehson bede
bad kolehso to ye file mirizam.
hala mikham hamishe update bashe baraye hamin hook gozahstam ke age ye processe jadidi ijad shod ya kill shod eb man etela bede ta ono be on file ezafe konam.
be nazaret rahe digei ham hast ke proceesa ro monitor konam berizam to file?

Desk Band

neoandrew18-Jul-06 7:45

neoandrew

18-Jul-06 7:45

Hi I created a desk band like a wmp-minibar, but i have one problem
- how to programically resize the windows toolbar, i've noticed that
wmp-mini bar do that - has anyone some idea? - please help!!!

and sorry for my english, i'm from poland Mad | :mad:

Listing running Apps

Kharfax18-Jul-06 7:23

18-Jul-06 7:23

Hi again people

How can I get a list of the running apps, like the one is shown in Task Manager in the Applications tab?

Thanks in advance Big Grin | :-D

Ravi Bhavnani18-Jul-06 7:30

Ravi Bhavnani

18-Jul-06 7:30

See this[^] article.

/ravi

My new year's resolution: 2048 x 1536
Home | Music | Articles | Freeware | Trips
ravib(at)ravib(dot)com

Kharfax18-Jul-06 7:37

18-Jul-06 7:37

Thanks mate, I already know about enumprocess, but that will list all the running process, like svchost.exe, lsass and all that.

What I would really like is to see only the Apps running.

Is there any way to filter the process list to get only the Apps?

Ali Rafiee18-Jul-06 7:43

Ali Rafiee

18-Jul-06 7:43

Does EnumWindows give you what you want?

AliR.
Visual C++ MVP

Kharfax18-Jul-06 7:48

18-Jul-06 7:48

I think that EnumWindows is what I was looking for Big Grin | :-D

I found also that task manager considers Application to any process with a visible window.

Thanks a lot Ali Big Grin | :-D

ThatsAlok19-Jul-06 6:17

ThatsAlok

19-Jul-06 6:17

Kharfax wrote:
found also that task manager considers Application to any process with a visible window

try FindWindow and FindWindowEx combination too!

"Opinions are neither right nor wrong. I cannot change your opinion. I can, however, change what influences your opinion." - David Crow

cheers,
Alok Gupta
VC Forum Q&A :- I/ IV
Support CRY- Child Relief and You

Hamid_RT18-Jul-06 18:56

Hamid_RT

18-Jul-06 18:56

See EnumProcesses

whitesky

Kharfax19-Jul-06 2:18