在窗户把手系统文件夹事件 [英] Handle system folders event in windows

问题描述

我写一些C＃代码，我需要，如果我的windows文件系统上的特定文件夹已经打开检测应用程序运行时。有没有办法做到这一点？ ？WinAPI的也许

I am writing some C# code and I need to detect if a specific folder on my windows file system has been opened while the application is running. Is there any way to do it? WinAPI maybe?

推荐答案

有三种API的事情，我想你应该看看：

There are three API things I think you should check out:

FindFirstChangeNotification（）的http：// MSDN .microsoft.com / EN-US /库/ aa364417％28VS.85％29.aspx
这就给了你一个句柄你可以等待并使用找到一个特定的文件对文件的更改，目录或目录树。它不会告诉你什么时候目录浏览，但它会告诉你，当一个文件被保存，重命名等等等等。

FindFirstChangeNotification() http://msdn.microsoft.com/en-us/library/aa364417%28VS.85%29.aspx That gives you a handle you can wait on and use to find changes to a file in a particular file, directory, or tree of directories. It won't tell you when a directory is browsed, but it will tell you when a file is saved, renamed, and so on and so forth.

调用SetWindowsHookEx（） http://msdn.microsoft.com/en -us /库/ ms644990％28V = VS.85％29.aspx
你可以设置最多时发生的任何数量的事件给你一个回调 - 其实我很积极，你目录打开时，可以得到这样的回调，但它可能会不相称困难的，因为你会被拦截消息探险家的窗口。所以，你会在调试过程中重新启动。

SetWindowsHookEx() http://msdn.microsoft.com/en-us/library/ms644990%28v=VS.85%29.aspx You can set that up to give you a callback when any number of events occur - in fact I'm pretty positive that you CAN get this callback when a directory is opened, but it will probably be inordinately difficult because you'll be intercepting messages to explorer's window. So you'll be rebooting during debugging.

Windows shell中的 http://msdn.microsoft.com/en-us/library/bb776778%28v=VS.85%29.aspx
如果这还不够痛，你可以尝试写一个shell程序。

Windows Shells http://msdn.microsoft.com/en-us/library/bb776778%28v=VS.85%29.aspx If that wasn't painful enough, you can try writing a shell program.

如果你想写一个rootkit的，我想你不想要我破坏的细节为您服务。如果你不尝试写了一个rootkit，我建议你看它 - 认真。有开放源码的rootkit，它们都基本上要监视的文件访问这种方式从用户/ OS隐藏。

If you're trying to write a rootkit, I suppose you don't want me to spoil the details for you. If you're NOT trying to write a rootkit, I suggest you look it up - carefully. There are open source rootkits, and they all basically have to monitor file access this way to hide from the user / OS.

这篇关于在窗户把手系统文件夹事件的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！