如何记录下WINDOWS的文件操作[比如什么时候创建、删除或修改一个文件]？ ( 积分: 200 )

dkzhuang · 2005-07-25

如何对网络共享盘操作？除上述功能我还需要对文件操作的用户IP。

dkzhuang · 2005-07-25

如何对网络共享盘操作？除上述功能我还需要对文件操作的用户IP。

boy2002cn · 2005-07-25

系统的HOOK可做到的

wqyzsh · 2005-07-26

比较复杂，可以参考windows核心编程一书

hzxhzx123 · 2005-08-13

陈省编的Delphi 深度探索(第二版)里有。

app2001 · 2005-08-13

我正好有一个例子，你看看吧，要源码就留EMAIL unit Unit1; interface uses  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,  Dialogs, StdCtrls, Shlobj, Activex, TFlatMemoUnit, TFlatSpeedButtonUnit,  TFlatAnimWndUnit, TFlatTitlebarUnit; const    SHCNE_RENAMEITEM = $1;    SHCNE_CREATE = $2;    SHCNE_DELETE = $4;    SHCNE_MKDIR = $8;    SHCNE_RMDIR = $10;    SHCNE_MEDIAINSERTED = $20;    SHCNE_MEDIAREMOVED = $40;    SHCNE_DRIVEREMOVED = $80;    SHCNE_DRIVEADD = $100;    SHCNE_NETSHARE = $200;    SHCNE_NETUNSHARE = $400;    SHCNE_ATTRIBUTES = $800;    SHCNE_UPDATEDIR = $1000;    SHCNE_UPDATEITEM = $2000;    SHCNE_SERVERDISCONNECT = $4000;    SHCNE_UPDATEIMAGE = $8000;    SHCNE_DRIVEADDGUI = $10000;    SHCNE_RENAMEFOLDER = $20000;    SHCNE_FREESPACE = $40000;    SHCNE_ASSOCCHANGED = $8000000;    SHCNE_DISKEVENTS = $2381F;    SHCNE_GLOBALEVENTS = $C0581E0;    SHCNE_ALLEVENTS = $7FFFFFFF;    SHCNE_INTERRUPT = $80000000;    SHCNF_IDLIST = 0;    // LPITEMIDLIST    SHCNF_PATHA = $1;    // path name    SHCNF_PRINTERA = $2;    // printer friendly name    SHCNF_DWORD = $3;    // DWORD    SHCNF_PATHW = $5;    // path name    SHCNF_PRINTERW = $6;    // printer friendly name    SHCNF_TYPE = $FF;    SHCNF_FLUSH = $1000;    SHCNF_FLUSHNOWAIT = $2000;    SHCNF_PATH = SHCNF_PATHW;    SHCNF_PRINTER = SHCNF_PRINTERW;    WM_SHNOTIFY = $401;    NOERROR = 0; type  TForm1 = class(TForm)    Memo1: TFlatMemo;    FlatSBRegister: TFlatSpeedButton;    FlatSBUnRegister: TFlatSpeedButton;    FlatSBSave: TFlatSpeedButton;    FlatSBQuit: TFlatSpeedButton;    Label1: TLabel;    procedure FormClose(Sender: TObject; var Action: TCloseAction);    procedure FlatSBRegisterClick(Sender: TObject);    procedure FlatSBUnRegisterClick(Sender: TObject);    procedure FlatSBQuitClick(Sender: TObject);    procedure FlatSBSaveClick(Sender: TObject);  private    procedure WMShellReg(var Msg : TMessage); Message WM_SHNOTIFY;    { Private declarations }  public    { Public declarations }  end;    type PSHNOTIFYSTRUCT=^SHNOTIFYSTRUCT;    SHNOTIFYSTRUCT = record    dwItem1 : PItemIDList;    dwItem2 : PItemIDList;  end;  Type PSHFileInfoByte=^SHFileInfoByte;    _SHFileInfoByte = record    hIcon :Integer;    iIcon :Integer;    dwAttributes : Integer;    szDisplayName : array [0..259] of char;    szTypeName : array [0..79] of char;  end;  SHFileInfoByte=_SHFileInfoByte;  Type PIDLSTRUCT = ^IDLSTRUCT;     _IDLSTRUCT = record     pidl : PItemIDList;     bWatchSubFolders : Integer;  end;  IDLSTRUCT =_IDLSTRUCT;  function SHNotify_Register(hWnd : Integer) : Bool;  function SHNotify_UnRegister:Bool;  function SHEventName(strPath1,strPath2:string;lParam:Integer):string;  Function SHChangeNotifyDeregister(hNotify:integer):integer;stdcall;  external 'Shell32.dll' index 4;  Function SHChangeNotifyRegister(hWnd,uFlags,dwEventID,uMSG,cItems:LongWord;  lpps

IDLSTRUCT):integer;stdcall;external 'Shell32.dll' index 2;  Function SHGetFileInfoPidl(pidl : PItemIDList;  dwFileAttributes : Integer;  psfib : PSHFILEINFOBYTE;  cbFileInfo : Integer;  uFlags : Integer):Integer;stdcall;  external 'Shell32.dll' name 'SHGetFileInfoA'; var  Form1: TForm1;  m_hSHNotify : Integer;  m_pidlDesktop : PItemIDList; implementation {$R *.dfm} function SHEventName(strPath1,strPath2:string;lParam:Integer):string; var  sEvent:String; begin    case lParam of //根据参数设置提示消息    SHCNE_RENAMEITEM: sEvent := '重命名文件'+strPath1+'为'+strpath2;    SHCNE_CREATE: sEvent := '建立文件文件名：'+strPath1;    SHCNE_DELETE: sEvent := '删除文件文件名：'+strPath1;    SHCNE_MKDIR: sEvent := '新建目录目录名：'+strPath1;    SHCNE_RMDIR: sEvent := '删除目录目录名：'+strPath1;    SHCNE_MEDIAINSERTED: sEvent := strPath1+'中插入可移动存储介质';    SHCNE_MEDIAREMOVED: sEvent := strPath1+'中移去可移动存储介质'+strPath1+' '+strpath2;    SHCNE_DRIVEREMOVED: sEvent := '移去驱动器'+strPath1;    SHCNE_DRIVEADD: sEvent := '添加驱动器'+strPath1;    SHCNE_NETSHARE: sEvent := '改变目录'+strPath1+'的共享属性';    SHCNE_ATTRIBUTES: sEvent := '改变文件目录属性文件名'+strPath1;    SHCNE_UPDATEDIR: sEvent := '更新目录'+strPath1;    SHCNE_UPDATEITEM: sEvent := '更新文件文件名：'+strPath1;    SHCNE_SERVERDISCONNECT: sEvent := '断开与服务器的连接'+strPath1+' '+strpath2;    SHCNE_UPDATEIMAGE: sEvent := 'SHCNE_UPDATEIMAGE';    SHCNE_DRIVEADDGUI: sEvent := 'SHCNE_DRIVEADDGUI';    SHCNE_RENAMEFOLDER: sEvent := '重命名文件夹'+strPath1+'为'+strpath2;    SHCNE_FREESPACE: sEvent := '磁盘空间大小改变';    SHCNE_ASSOCCHANGED: sEvent := '改变文件关联';    else    sEvent:='未知操作'+IntToStr(lParam);    end;    Result:=sEvent; end; function SHNotify_Register(hWnd : Integer) : Bool; var // ps

IDLSTRUCT; ps : _IDLSTRUCT; begin {$R-}  Result:=False;  If m_hSHNotify = 0 then begin  //获取桌面文件夹的Pidl  if SHGetSpecialFolderLocation(0, CSIDL_DESKTOP,m_pidlDesktop) <> NOERROR then  Form1.close;  if Boolean(m_pidlDesktop) then begin  ps.bWatchSubFolders := 1;  ps.pidl := m_pidlDesktop;  // 利用SHChangeNotifyRegister函数注册系统消息处理  m_hSHNotify := SHChangeNotifyRegister(hWnd, (SHCNF_TYPE Or SHCNF_IDLIST),  (SHCNE_ALLEVENTS Or SHCNE_INTERRUPT),  WM_SHNOTIFY, 1, @ps);  Result := Boolean(m_hSHNotify);  end  Else  // 如果出现错误就使用 CoTaskMemFree函数来释放句柄  CoTaskMemFree(m_pidlDesktop); End; {$R+} end; function SHNotify_UnRegister:Bool; begin  Result:=False;  If Boolean(m_hSHNotify) Then  //取消系统消息监视，同时释放桌面的Pidl  If Boolean(SHChangeNotifyDeregister(m_hSHNotify)) Then  begin   {$R-}    m_hSHNotify := 0;    CoTaskMemFree(m_pidlDesktop);    Result := True;   {$R-}  End; end; procedure TForm1.WMShellReg(var Msg:TMessage); //系统消息处理函数 var  strPath1,strPath2 : String;  charPath :array[0..259]of char;  pidlItem : PSHNOTIFYSTRUCT; begin   pidlItem:=PSHNOTIFYSTRUCT(Msg.wParam);    //获得系统消息相关得路径   SHGetPathFromIDList(pidlItem.dwItem1,charPath);   strPath1:=charPath;   SHGetPathFromIDList(pidlItem.dwItem2,charPath);   strPath2:=charPath;   Memo1.Lines.Add(SHEvEntName(strPath1,strPath2,Msg.lParam)); end; procedure TForm1.FormClose(Sender: TObject; var Action: TCloseAction); begin  if Boolean(m_pidlDesktop) then    SHNotify_Unregister; end; procedure TForm1.FlatSBRegisterClick(Sender: TObject); begin  m_hSHNotify:=0;  if SHNotify_Register(Form1.Handle) then begin //注册Shell监视  Application.MessageBox('Shell监视程序成功注册！', '信息', 0);  FlatSBRegister.Enabled := False;  end  else  Application.MessageBox('Shell监视程序注册失败！', '信息', 0); end; procedure TForm1.FlatSBUnRegisterClick(Sender: TObject); begin if Boolean(m_pidlDesktop) then  SHNotify_Unregister; FlatSBRegister.Enabled := True; end; procedure TForm1.FlatSBQuitClick(Sender: TObject); begin  Close(); end; procedure TForm1.FlatSBSaveClick(Sender: TObject); begin  Memo1.Lines.SaveToFile('c:/tmp.txt'); end; end.

dkzhuang · 2005-08-17

To app2001:  这个文件夹的问题已经基本解决了，再深层问一下。 　如何对网络共享盘操作？除上述功能我还需要登录的用户IP。 　简单的说就是谁对文件或文件夹进行怎样的操作。

app2001 · 2005-08-17

这个就有等于你的慢慢研究了,这方面我了解的就不多了

如何记录下WINDOWS的文件操作[比如什么时候创建、删除或修改一个文件]？ ( 积分: 200 )

dkzhuang

Unregistered / Unconfirmed

dkzhuang

Unregistered / Unconfirmed

boy2002cn

Unregistered / Unconfirmed

wqyzsh

Unregistered / Unconfirmed

hzxhzx123

Unregistered / Unconfirmed

app2001

Unregistered / Unconfirmed

dkzhuang

Unregistered / Unconfirmed

app2001

Unregistered / Unconfirmed

Similar threads