从 C++ 挂钩到 Windows 文件复制 API
我需要挂钩 copyfile 以便在复制恶意文件时停止该进程。我看到 Cat Man Do 提出的问题
Hook into the Windows File Copy API from C#
他提到在 C++ 中有一个解决这个问题的方法。我正在使用 embarcadero c++ builder（非 MFC）。这个解决方案是否适用于 c++ 构建器，如果适用，任何人都可以发布链接或给我有关如何在 c++ 中挂钩 copyfile 的提示吗？
I need to hook copyfile in order to stop the process whenever a malicious file is being copied. I saw a question asked by Cat Man Do
Hook into the Windows File Copy API from C#
and he mentioned that there is a solution for this problem in c++. I am using embarcadero c++ builder(non-MFC). Is this solution applicable for c++ builder and if it is can anybody post the link or give me a hint on how to hook copyfile in c++?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您没有具体说明“停止进程”的含义 - 是否有您感兴趣的特定进程，或者您是否想要阻止整个系统中的所有文件副本。如果您想阻止整个系统中的所有文件副本，那么您需要的是 文件系统过滤器驱动程序。这是非常先进的，因为您将编写内核模式驱动程序。 不适合胆小的人。另请注意，您最终可能会被标记为恶意软件，因为恶意软件会尝试挂钩文件系统以隐藏自己。
You're not being specific about what you mean by "stop the process" - whether there is a specific process you are interested in, or whether you want to block all file copies throughout the entire system. If you want to block all file copies throughout the system, then what you're looking for is a file system filter driver. This is extremely advanced, since you will be writing a kernel-mode driver. Not for the faint of heart. Note also that you may end up being flagged as malware yourself, since malware will try to hook the file system in order to hide themselves.
我建议使用 Deviare API hook 来完成此操作。您可以使用其 COM 对象来拦截 CopyFile 和 CopyFileEx API，并防止调用在最后一个错误中返回 ACCESS DENIED。
I recommend using Deviare API hook to do it. You can use its COM objects to intercept CopyFile and CopyFileEx APIs and prevent the call returning ACCESS DENIED in the last error.