拦截 Windows 7 中程序的输出
我有一个可执行程序，它将数据输出到硬盘，例如 C:\documents。
我需要一些方法来在 Windows 7 中的数据到达硬盘之前拦截它们。然后我会将数据加密并发回硬盘。不幸的是，.exe 文件不支持重定向命令 ie >在命令提示符下。你知道我如何用任何编程语言（c、c++、JAVA、php）实现这样的事情吗？
加密只能在纯数据发送到磁盘之前完成，而不是之后完成。
任何想法都非常受欢迎。谢谢
I have an executable program which outputs data to the harddisk e.g. C:\documents.
I need some means to intercept the data in Windows 7 before they get to the hard drive. Then I will encrypt the data and send it back to the harddisk. Unfortunately, the .exe file does not support redirection command i.e. > in command prompt. Do you know how I can achieve such a thing in any programming language (c, c++, JAVA, php).
The encryption can only be done before the plain data is sent to the disk not after.
Any ideas most welcome. Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
这在一般情况下几乎是不可能的。许多程序使用内存映射文件写入磁盘。在这样的方案中，内存范围被映射到文件（的一部分）。在这种方案中，无法区分对文件的写入和对内存的写入。像
p[OFFSET_OF_FIELD_X] = 17;这样的语句是对文件的逻辑写入。此外，操作系统将跟踪内存和磁盘的同步。并非所有对内存的逻辑写入都会直接转换为对磁盘的物理写入。有时，根据操作系统的突发奇想，脏内存页会被复制回磁盘。即使在更简单的 CreateFile/WriteFile 情况下，也几乎没有空间来即时拦截数据。您可以实现的最接近的方法是使用 Microsoft Detours。我知道至少有一个万金油加密程序（WxVault，戴尔上提供的垃圾软件）可以做到这一点。它反复使我的应用程序在现场崩溃，这就是为什么我的程序会取消任何动态拦截数据的尝试。因此，即使是这样的黑客攻击也无法抵御不喜欢干扰的程序。
This is virtually impossible in general. Many programs write to disk using memory-mapped files. In such a scheme, a memory range is mapped to (part of) a file. In such a scheme, writes to file can't be distinguished from writes to memory. A statement like
p[OFFSET_OF_FIELD_X] = 17;is a logically write to file. Furthermore, the OS will keep track of the synchronization of memory and disk. Not all logical writes to memory are directly translated into physical writes to disk. From time to time, at the whim of the OS, dirty memory pages are copied back to disk.Even in the simpler case of
CreateFile/WriteFile, there's little room to intercept the data on the fly. The closest you could achieve is the use of Microsoft Detours. I know of at least one snakeoil encyption program (WxVault, crapware shipped on Dells) that does that. It repeatedly crashed my application in the field, which is why my program unpatches any attempt to intercept data on the fly. So, not even such hacks are robust against programs that dislike interference.