显示访问文件夹的进程
我正在尝试编写一个简单的程序（最好用 C 语言）来监视给定的目录。每当进程访问该目录时，我只想打印出该进程的名称。看起来很简单，但我在 MSDN 上找不到解决方案。有谁知道我需要哪个图书馆的电话，或者有任何有用的建议？我已经考虑过反复查询哪些进程在给定目录上有句柄，并只是观察该列表中的添加内容。这种方法似乎非常密集，我希望有一种更简单的方法。谢谢。
I am trying to write a simple program, preferably in C, that will watch a given directory. Whenever a process accesses that directory, I just want to print out the name of that process. It seems simple, but I am coming up short for solutions on MSDN. Does anyone know which library calls I will need for this, or any helpful advice? I have considered repeatedly querying for what processes have handles on the given directory and just watching for additions to that list.This approach just seems very intensive and I am hoping there is an easier way. Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我不确定是否有更简单的方法，但一种方法是使用 文件系统过滤驱动程序。或者更简单的文件系统微筛选器驱动程序。
您可以过滤、记录、跟踪、控制……所有 IO。
I'm not sure if there's an easier way, but one way is to use a file system filter driver. Or easier a file system minifilter driver.
You can filter, log, track, control, ... all IO.
不支持从用户模式执行此操作的方法。您可以使用 FindFirstChangeNotification API 来判断何时文件或目录已更改，但这并不能告诉您是谁做的。您也许可以挂钩一些东西来获取此信息......但这当然不受支持。
如果您可以使用驱动程序，则可以使用Windows 事件跟踪对于此信息。这就是 Sysinternals ProcMon 使用的方法。但是安装驱动程序是一个非常侵入性的过程，驱动程序中的错误会导致 BSOD，并且驱动程序的安装需要管理权限。需要记住的事情。
There is no supported way to do this from user mode. You can use the FindFirstChangeNotification API to tell when a file or directory has changed, but that doesn't tell you who did it. You might be able to hook some things to obtain this information... but that is of course not supported.
If you can use a driver, you can use Event Tracing for Windows for this information. This is what Sysinternals ProcMon uses. But installation of a driver is a very invasive process, bugs in your driver cause BSODs, and installation of a driver requires administrative rights. Something to keep in mind.