在 Windows 中，如何在 C 中跟踪子进程读取和写入的文件？

Question

My goal is to determine when executing a command, precisely which files it reads and writes. On Linux I can do this using ptrace (with work, akin to what strace does) and on FreeBSD and MacOS I can do this with the ktrace system command. What would you use to obtain this information on Windows?

My research so far suggests that I either use the debugger interface (similar to ptrace in many ways) or perhaps ETW . A third alternative is to interpose a DLL to intercept system calls as they are made. Unfortunately, I don't have the experience to guess as to how challenging each of these approaches will be.

Any suggestions?

Answer 1

As you suggested, this is a fairly simple task to solve with API hooking with DLL injection.

This is a pretty good article about the application: API hooking revealed

I believe you can find more recent articles about the issue.

However, you probably need to use C++ to implement such a utility. By the way, programs can disable DLL injection. For example, I weren't able to use this approach on the trial version of Photoshop .

So, you may want to check if you can inject DLL files in the process you want with an existing solution before you start writing your own.

Answer 2

Unfortunately it seems there is no easy way to intercept file level operations on Windows.

Here are some hints:

• you could try to use FileMon from Sysinternals if it is enough for your needs, or try to look at the source of the tool
• you could make use of commercial software like Detours - beware, I never used that myself and I'm not sure it really meets your needs

If you want a better understanding and are not frightened at doing it by hand , the Windows way of intercepting file I/O is using a File System Filter Driver . In fact, there is a FilterManager embedded in Windows system that can forward all file system calls to minifilters .

To build it, the interface with the system is provided by the FilterManager, and you have just (...) to code and install the minifilter that does the actual filtering - beware again never tested that ...

Answer 3

Please, take a look to the article CDirectoryChangeWatcher - ReadDirectoryChangesW all wrapped up .

It is a very old, but running, way to watch directory changes.

Answer 4

Microsoft owns a bunch of tools called Sysinternals . There is a program called Process Monitor that will show you all the file accesses for a particular process. This is very likely what you want.

Answer 5

Check this particular Stack Overflow question out for your question... This might help you: Is there something like the Linux ptrace syscall in Windows?

Also, if you are running lower versions like Windows XP then you should check out Process Monitor .

Also, I would like you to check this out... Monitoring certain system calls done by a process in Windows