检测到正在读取文件而没有管理或系统特权 [英] Detecting that a file is being read without administrative or system previleges

问题描述

我想知道我是否可以创建一种应用程序，而该应用程序无需注册服务，也无需提高执行权限即可获得管理员或系统特权，就可以检测到某个特定文件正在通过网络读取或共享(例如通过Windows文件共享).客户端将运行Vista.

有没有办法通过标准API或作为黑客来检测到这一点?

谢谢.

I wonder if there is any way for me to create an application that, without registering a service and without being elevated to get administrator or system privileges upon execution, can detect that a specific file is being read or shared over a network (through Windows file sharing, for example). The client will run Vista.

Is there a way through the standard API or as a hack to detect this?

Thank you.

推荐答案

使用SHChangeNotifyRegister可获得有限的通知.为了使每个文件都可能发生更改，您需要安装一个在内核中运行的文件过滤器驱动程序.

Use SHChangeNotifyRegister to get limited notifications. To get every file change possible, you need install a file filter driver running in the kernel.

这篇关于检测到正在读取文件而没有管理或系统特权的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！