In DOS you can trap interrupts, but in windows?

[Nawabzada]

Hello Friends -

Say that I would like to have a log of installed/Created files.

in DOS i just trap an interrupt (INT 21, 4b or something) and then
wrote the filename to a file and let the program continue its work.

How can I create a similar program workin in windows(98/NT/2000)?

The thing I basically wanna do is the same as antivirus programs do.
They check all the files that are opened/run.

How do they do it?

Thanks for Your Attention.

-n

 

[Keith Thompson]

Say that I would like to have a log of installed/Created files.

in DOS i just trap an interrupt (INT 21, 4b or something) and then
wrote the filename to a file and let the program continue its work.

How can I create a similar program workin in windows(98/NT/2000)?

[...]

Again this isn't really a C question.

 

[jacob navia]

Hello Friends -

Say that I would like to have a log of installed/Created files.

in DOS i just trap an interrupt (INT 21, 4b or something) and then
wrote the filename to a file and let the program continue its work.

How can I create a similar program workin in windows(98/NT/2000)?

The thing I basically wanna do is the same as antivirus programs do.
They check all the files that are opened/run.

How do they do it?

Thanks for Your Attention.

-n

basically you should write your own dll that replaces the system dll
where the file functions are defined. Then, you do your stuff and then,
you call the original system dll with the same arguments that you
received.

Tricky but doable.

 

[Flash Gordon]

basically you should write your own dll that replaces the system dll
where the file functions are defined. Then, you do your stuff and then,
you call the original system dll with the same arguments that you
received.

Tricky but doable.

Oh, the problems with that method, let me count the ways it will fail...
Windows update replacing your replacement
Your Anti-Virus SW preventing you from doing it
Your anti-rootkit software preventing you from doing it
Sensible access controls preventing you from doing it
....

An MS group might be able to suggest a better option. I know there are
good ways to do it in Linux, and I'm sure there are proper methods for
Windows.

 

[jacob navia]

Oh, the problems with that method, let me count the ways it will fail...
Windows update replacing your replacement

You don't replace the system dll!
You replace the function being called by creating a dll that intercepts
the dynamic loader.

Your Anti-Virus SW preventing you from doing it

Disable the antivirus

Your anti-rootkit software preventing you from doing it

this is only in the imagination of tired linux hackers

Sensible access controls preventing you from doing it

You do not understand windows. Please stay away or learn something.

Google for "dll injection".

...

An MS group might be able to suggest a better option. I know there are
good ways to do it in Linux, and I'm sure there are proper methods for
Windows.

Yes, they boil down to what I am proposing.

 

[jacob navia]

[...]

And this, my dear friends, is precisely why OS-specific questions belong
in OS-specific newsgroups and not clc.

QED.

Of course when in other threads right now the linux kernel is discussed
you will never complain, like the other regulars.

Double standards, because as everyone knows, windows programmers are
just slaves of Microsoft isn't it?

OS specific threads will be banned if that OS is Microsoft Windows.

For instance the thread

"Binding raw devices in Linux Kernel 2.6" (July 6-7th)

was never interrupted by the regulars.

 

[Keith Thompson]

Flash Gordon wrote:
jacob navia wrote:
Nawabzada wrote:

[...]

And this, my dear friends, is precisely why OS-specific questions
belong in OS-specific newsgroups and not clc.

QED.

Of course when in other threads right now the linux kernel is discussed
you will never complain, like the other regulars.

Double standards, because as everyone knows, windows programmers are
just slaves of Microsoft isn't it?

OS specific threads will be banned if that OS is Microsoft Windows.

For instance the thread

"Binding raw devices in Linux Kernel 2.6" (July 6-7th)

was never interrupted by the regulars.

That thread was (inappropriately) cross-posted to comp.os.linux.misc,
comp.lang.c, and alt.comp.linux. There were 7 articles in the
thread; all of them appear to have been posted from the Linux groups.
It appears that the original poster's problem was solved. I or
someone else could have posted a reply suggesting that comp.lang.c
be dropped from the cross-post, but we didn't bother. We are not
police officers; we are under no obligation to complain about every
off-topic post.

It was inappropriate for comp.lang.c. Nobody did anything about it.
It happens.

This thread, on the other hand, was posted solely to comp.lang.c,
which is why I posted a followup suggesting that this was not the
appropriate place for it -- not just to keep irrelevencies out of
comp.lang.c but because the OP can get *better advice* elsewhere.
You seem to know Windows programming better than most clc posters,
certainly better than I do -- but do you seriously think that
the OP's question belongs in comp.lang.c rather than, say,
comp.os.ms-windows.programmer.win32?

If you had a question about, say, trapping interrupts in Windows,
where would you ask it?

Maybe we should advise people with Windows questions to just e-mail
them to you directly. Then you can show off your expertise without
the bother of other people disagreeing with you.

 

[Antoninus Twink]

We are not police officers; we are under no obligation to complain
about every off-topic post.

Glad to hear you've finally realized that, Keith.

 

[Phil Carmody]

Say that I would like to have a log of installed/Created files.

in DOS i just trap an interrupt (INT 21, 4b or something) and then
wrote the filename to a file and let the program continue its work.

How can I create a similar program workin in windows(98/NT/2000)?

[...]

Again this isn't really a C question.

And posted via an anonymising server.

Where's Han?

Phil

 

[Keith Thompson]

Say that I would like to have a log of installed/Created files.

in DOS i just trap an interrupt (INT 21, 4b or something) and then
wrote the filename to a file and let the program continue its work.

How can I create a similar program workin in windows(98/NT/2000)?

[...]

Again this isn't really a C question.

And posted via an anonymising server.

aioe.org isn't *specifically* an anonymizing server. It's just an
ordinary free Usenet server, though it doesn't require you to post
under your real name. I used to use it myself, and I used my real
name. I don't find the use of the name "Nawabzada" (which may or may
not be a pseudonym) or of a bogus e-mail address particularly
suspicious. (Though since spam.org is a real, using it in a bogus
return address is unwise.)

 

[Dik T. Winter]

> Of course when in other threads right now the linux kernel is discussed
> you will never complain, like the other regulars.

Irony and so on is lost on you?

 

[Richard Bos]

You don't replace the system dll!
You replace the function being called by creating a dll that intercepts
the dynamic loader.

Replacing a function using a program-local DLL is not at all the same
thing as replacing the system DLL.

Disable the antivirus

....and get killed by your sysadmin, for good reasons. If the sysadmin
was wise, you can't even do this.

Richard