当进程访问文件时中断调试器，或者从进程获取文件访问的调用堆栈
我正在处理大约数十万行代码，并且我很困惑这个进程在哪里访问特定文件。我已经放弃搜索代码了，我就是找不到。
所以，我在这里提出一个问题，我几乎可以肯定没有简单的解决方案。
我尝试过 SysInternals 的 FileMon、ProcMon，虽然我可以看到文件已被访问，但它没有显示调用堆栈或任何有用的信息。
我希望当这种情况发生时我能够闯入调试器；我想也许我可以为 FileMon 编写一些扩展，当访问发生时它会向我发出信号，然后我可以将 Debug.Break 放入我的进程中。
任何见解或想法表示赞赏。
I'm dealing with some hundreds of thousands of lines of code, and I'm stumped where this process is accessing a particular file. I've given up searching the code, I just cannot find out.
So, here I am -- asking a question I'm almost certain there is no simple solution for.
I've tried FileMon, ProcMon from SysInternals, and while I can see the file got accessed, it doesn't show the call stack or any useful piece of information.
I wish I could break into the debugger when that happens; I thought maybe I could write some extension for FileMon that would signal to me when an access happens, and then I could throw a Debug.Break into my process.
Any insight or ideas appreciated.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
在 CreateFile() 上设置断点。在 main() 中编写一个，以便您可以轻松地跟踪它并找到 API 入口点。单步执行前切换到反汇编视图。
Set a breakpoint on CreateFile(). Write one in main() so you can easily trace into it an find the API entrypoint. Switch to disassembly view before single-stepping.
该文件是由程序创建的还是预先存在的？如果您重命名磁盘上的文件会发生什么，也许这可以帮助您获得堆栈跟踪？如果它是由程序生成的，文件名是否遵循特定模式，也许您可以查找填充此模式的格式字符串，例如“c:\%d-%d-%d.txt”，然后查找使用该字符串的行。
Is the file created by the program or is it pre-existing? What would happen if you renamed the file on disk, maybe that could help you get a stack trace? If it's generated by the program does the file name adhere to a specific pattern, maybe you could look for the format string that populates this pattern, e.g. "c:\%d-%d-%d.txt", and then look for the lines that use this string.