Advertisement
Guest User

Untitled

a guest
Jan 25th, 2020
130
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C++ 1.70 KB | None | 0 0
  1. class NDC : public IO_OBJECT
  2. {
  3.     union {
  4.         FILE_NOTIFY_INFORMATION fni;
  5.         UCHAR buf[0x1000];
  6.     };
  7.  
  8.     void Start()
  9.     {
  10.         HANDLE hFile;
  11.         if (LockHandle(hFile))
  12.         {
  13.             if (IO_IRP* irp = new IO_IRP(this, 0, 0))
  14.             {
  15.                 irp->CheckError(ReadDirectoryChangesW(hFile, buf, sizeof(buf), TRUE, FILE_NOTIFY_VALID_MASK, 0, irp, 0));
  16.             }
  17.             UnlockHandle();
  18.         }
  19.     }
  20.  
  21.     virtual void IOCompletionRoutine(CDataPacket* /*packet*/, DWORD /*Code*/, NTSTATUS status, ULONG_PTR dwNumberOfBytesTransfered, PVOID /*Pointer*/)
  22.     {
  23.         DbgPrint("IOCompletionRoutine(%u, %p)\n", status, dwNumberOfBytesTransfered);
  24.  
  25.         switch (status)
  26.         {
  27.         case NOERROR:
  28.             union {
  29.                 PBYTE pb;
  30.                 PFILE_NOTIFY_INFORMATION pfni;
  31.             };
  32.  
  33.             pfni = &fni;
  34.             ULONG NextEntryOffset = 0;
  35.             do
  36.             {
  37.                 pb += NextEntryOffset;
  38.                 DbgPrint("[%u] %.*S\n", pfni->Action, pfni->FileNameLength / sizeof(WCHAR), pfni->FileName);
  39.             } while (NextEntryOffset = pfni->NextEntryOffset);
  40.  
  41.             //Sleep(4000);// !!!
  42.  
  43.         case ERROR_NOTIFY_ENUM_DIR:
  44.             Start();
  45.         }
  46.     }
  47.  
  48. public:
  49.     ULONG Create(PCWSTR psz)
  50.     {
  51.         HANDLE hFile = CreateFileW(psz, FILE_GENERIC_READ, FILE_SHARE_VALID_FLAGS, 0, OPEN_EXISTING,
  52.             FILE_FLAG_OVERLAPPED | FILE_FLAG_BACKUP_SEMANTICS, 0);//
  53.  
  54.         if (hFile != INVALID_HANDLE_VALUE)
  55.         {
  56.             Assign(hFile);
  57.            
  58.             if (ULONG dwError = IO_IRP::BindIoCompletion(hFile))
  59.             {
  60.                 return dwError;
  61.             }
  62.  
  63.             Start();
  64.  
  65.             return NOERROR;
  66.         }
  67.  
  68.         return GetLastError();
  69.     }
  70. };
  71.  
  72. void DemoSpy(PCWSTR szFile)
  73. {
  74.     if (NDC* p = new NDC)
  75.     {
  76.         p->Create(szFile);
  77.         MessageBoxW(0, 0, L"Start motitor and UI running", MB_ICONINFORMATION);
  78.         p->Close();
  79.         p->Release();
  80.         MessageBoxW(0, 0, L"Stop monitor", MB_ICONINFORMATION);
  81.     }
  82. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement