要求 Windows 将数据写入磁盘的不同方法
通常，当应用程序写入磁盘上的文件之一时，文件修改时间戳会发生变化。
有时，就我而言，它是用 ProvideX（我认为是 Business Basic 的衍生品）编写的应用程序进行写入，修改后的时间戳在写入后不会更改。像 MyTrigger 这样的程序也不会接收写入操作，但 Sysinternals ProcessMonitor 会记录磁盘活动。
显然，有不同的方法可以要求窗口执行写入操作，并且该请求也可以以各种不同的方式被挂钩或记录。
我需要能够挂钩来自 ProvideX 应用程序的写入操作。任何有关 Windows 写入磁盘的不同方式以及可用的挂钩类型的指针都将不胜感激。
谢谢
Usually, when an application writes to one of it's files on disk, the file modified timestamp changes.
Sometimes, and in my case it is an application written in ProvideX (a Business Basic derivative i believe) doing the writing, the modified timestamp does not change after a write. A program like MyTrigger will not pick up on the write operation either, but Sysinternals ProcessMonitor does log the disk activity.
It seems obvious that there are different ways to ask windows to perform write operations, and the request could then be hooked or logged in various different ways as well.
I need to be able to hook the write operations coming from the ProvideX application. Any pointers on the different ways windows writes to disk, and the type of hooks available for them would be greatly appreciated.
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
用户模式进程可以使用 WriteFile API 函数或使用 MMF、内存映射文件 API (CreateFileMapping/MapViewOfFile/Write to memory block) 写入文件。也许您的应用程序采用 MMF 方式。 MMF 写入文件的方式与 WriteFile API 非常不同，但它们都导致相同的端点 - 发送到文件系统驱动程序的 IRP。文件系统过滤器驱动程序（例如 Sysinternals 使用的过滤器驱动程序）可以跟踪该 IRP 级别上的写入请求。技术上可以通过发送不同的IRP（涉及缓存和非缓存写入）来区分MMF和WriteFile发起的写操作。看来Windows中的目录更改监视功能只跟踪一种IRP类型，这会导致MyTrigger错过更改。
User-mode process can write to the file either using WriteFile API function or using MMF, memory-mapped file API (CreateFileMapping/MapViewOfFile/Write to memory block). Maybe your application goes MMF way. MMF writes to files very differently from WriteFile API, but they both lead to the same end point - IRP sent to file system driver. File system filter driver (such as the one used by Sysinternals stuff) can track write requests on that IRP level. It is technically possible to distinguish between write operations initiated by MMF and WriteFile as different IRPs are sent (cached and non-cached writing is involved). It seems that directory change monitoring function in windows tracks only one IRP type, and this causes MyTrigger to miss the change.