Spying a File System

Click here for a larger image.

Describes how to create the basis for a file system spy application

Introduction

Windows applications can do dynamic monitoring of the specified directory. Once changes occur and are detected, a spy application can run various tasks (run antivirus, log activity, determine more information about changes, or call other tasks).

The Win 32 API provides three functions that are based on the following events:

• FindFirstChangeNotification
• FindNextChangeNotification
• FindCloseChangeNotification
• ReadDirectoryChangesW

This allows you to create a watchdog or spying application.

How to Create the Application

First of all, a spy application should call FindFirtsChangeNotification to create an event handler to monitor changes specified as the function's parameters.

HANDLE h = FindFirtsChangeNotification(C:\\Program Files,
                                        TRUE, mask);

This function allows us to handle the following types of notifications:

The result of FindFirtsChangeNotification can be passed as a parameter in to WaitForSingleObject. When the specified event occurs, the application can do various actions, such as antivirus starting, adding a record to the log file, and so on. Note that this function does not detect changes; it only creates a synchronization event and marks it if changes are made. After our spy application handling changes, it should call FindNextChangeNotification to continue monitoring, or FindCloseChangeNotification to finish it.

The Win32 API also provides ReadDirectoryChangesW that can operate with the following filters (MSDN):

Sample

Please pay attention to the following code in the demo project:

void ThreadRoute( void* arg )
  {
  HANDLE file;
  file = FindFirstChangeNotification("c:\\Program Files",
                                     FALSE, (DWORD)
                                     ((Param*)arg)->parameter);
  WaitForSingleObject(file, INFINITE);

  CTime tm = CTime::GetCurrentTime();
  m_Sec.Lock();
  int item = pList->InsertItem(pList->GetItemCount(),
             ((Param*)arg)->message);
  pList->SetItemText(item, 1, tm.Format("%Y/%m/%d - %H:%M:%S"));
  m_Sec.Unlock();

  while (true)
    {
    FindNextChangeNotification(file);
    WaitForSingleObject(file, INFINITE);
    tm = CTime::GetCurrentTime();
    m_Sec.Lock();
    int item = pList->InsertItem(pList->GetItemCount(),
               ((Param*)arg)->message);
    pList->SetItemText(item, 1, tm.Format("%Y/%m/%d/ - %H:%M:%S"));
    m_Sec.Unlock();
    }
  }

and the fragment that uses ReadDirectoryChangesW:

void ThreadRoute1( void* arg )
  {
  USES_CONVERSION;
  HANDLE hDir = CreateFile( CString("c:\\Program Files"),
                                        /* pointer to the file
                                           name */
    FILE_LIST_DIRECTORY,                /* access (read-write)
                                           mode */
    FILE_SHARE_READ|FILE_SHARE_DELETE,  /* share mode */
    NULL,                               /* security descriptor */
    OPEN_EXISTING,                      /* how to create */
    FILE_FLAG_BACKUP_SEMANTICS,         /* file attributes */
    NULL                                /* file with attributes to
                                           copy */
  );

  FILE_NOTIFY_INFORMATION Buffer[1024];
  DWORD BytesReturned;
  while( ReadDirectoryChangesW(
                                hDir,            /* handle to
                                                    directory */
                                &Buffer,         /* read results
                                                    buffer */
                                sizeof(Buffer),  /* length of
                                                    buffer */
                                TRUE,            /* monitoring
                                                    option */
                                FILE_NOTIFY_CHANGE_SECURITY|
                                FILE_NOTIFY_CHANGE_CREATION|
                                FILE_NOTIFY_CHANGE_LAST_ACCESS|
                                FILE_NOTIFY_CHANGE_LAST_WRITE|
                                FILE_NOTIFY_CHANGE_SIZE|
                                FILE_NOTIFY_CHANGE_ATTRIBUTES|
                                FILE_NOTIFY_CHANGE_DIR_NAME|
                                FILE_NOTIFY_CHANGE_FILE_NAME,
                                                 /* filter
                                                    conditions */
                                &BytesReturned,  /* bytes
                                                    returned */
                                NULL,            /* overlapped
                                                    buffer */
                                NULL))...        /* completion
                                                    routine */

These are thread functions that do the described spying actions.

Conclusion

The demo application starts separate threads to monitor all possible changes in the C:\\Program Files directory and shows occurred notifications and their date/time in the List control. The demo applicaton also shows how to use ReadDirectoryChangesW and compare both methods visually.

Functionality of the demo application can be extended to determine concrete changes, to log changes in to file, run external applications or tasks on the specified event, use described methods as system service, and so on. Readers have full spaciousness for demo usage.

Downloads