Hey,

I know when a file is read, writen or modified (attributes) using Win32::AdvNotify or PodMasters nice module Win32::ReadDirectoryChanges. However, I wanna know when a file is opened or closed! I've found this:


"How FileMon Works

For the Windows 9x driver, the heart of FileMon is in the virtual device driver, Filevxd.vxd. It is dynamically loaded, and in its initialization it installs a file system filter via the VxD service, IFSMGR_InstallFileSystemApiHook, to insert itself onto the call chain of all file system requests. On Windows NT the heart of FileMon is a file system driver that creates and attaches filter device objects to target file system device objects so that FileMon will see all IRPs and FastIO requests directed at drives. When FileMon sees an open, create or close call, it updates an internal hash table that serves as the mapping between internal file handles and file path names. Whenever it sees calls that are handle based, it looks up the handle in the hash table to obtain the full name for display. If a handle-based access references a file opened before FileMon started, FileMon will fail to find the mapping in its hash table and will simply present the handle's value instead."

Information on accesses is dumped into an ASCII buffer that is periodically copied up to the GUI for it to print in its listbox. "

Using that and just opening a text file it spits out: 

18:06:33    cmd.exe:3564    IRP_MJ_READ*    E:    SUCCESS    Offset: 7
+7824 Length: 4096    
18:06:33    cmd.exe:3564    IRP_MJ_READ*    E:    SUCCESS    Offset: 0
+ Length: 4096    
18:06:33    cmd.exe:3564    IRP_MJ_READ*    E:    SUCCESS    Offset: 0
+ Length: 4096    
18:06:33    cmd.exe:3564    FASTIO_QUERY_OPEN    E:\test.txt    SUCCES
+S    Attributes: A    
18:06:33    cmd.exe:3564    IRP_MJ_CREATE     E:\    SUCCESS    Option
+s: Open Directory  Access: All    
18:06:33    cmd.exe:3564    IRP_MJ_DIRECTORY_CONTROL    E:\    SUCCESS
+    FileBothDirectoryInformation: test.txt    
18:06:33    cmd.exe:3564    IRP_MJ_CLEANUP    E:\    SUCCESS        
18:06:33    cmd.exe:3564    IRP_MJ_CLOSE     E:\    SUCCESS        
18:06:33    cmd.exe:3564    IRP_MJ_CREATE     E:\test.txt    SUCCESS  
+  Options: Open  Access: All    
18:06:33    System:3564    IRP_MJ_CLEANUP    E:    SUCCESS        
18:06:33    cmd.exe:3564    IRP_MJ_READ*    E:    SUCCESS    Offset: 0
+ Length: 4096    
18:06:33    cmd.exe:3564    FASTIO_QUERY_STANDARD_INFO    E:\test.txt 
+   SUCCESS    Length: 512    
18:06:33    cmd.exe:3564    IRP_MJ_CREATE     E:\    SUCCESS    Option
+s: Open Directory  Access: All    
18:06:33    cmd.exe:3564    IRP_MJ_DIRECTORY_CONTROL    E:\    SUCCESS
+    FileBothDirectoryInformation: test.txt    
18:06:33    cmd.exe:3564    IRP_MJ_CLEANUP    E:\    SUCCESS        
18:06:33    cmd.exe:3564    IRP_MJ_CLOSE     E:\    SUCCESS        
18:06:33    cmd.exe:3564    FASTIO_QUERY_OPEN    E:\test.txt    SUCCES
+S    Attributes: A    
18:06:33    cmd.exe:3564    IRP_MJ_CREATE     E:\    SUCCESS    Option
+s: Open Directory  Access: All    
18:06:33    cmd.exe:3564    IRP_MJ_DIRECTORY_CONTROL    E:\    SUCCESS
+    FileBothDirectoryInformation: test.txt    
18:06:33    cmd.exe:3564    IRP_MJ_CLEANUP    E:\    SUCCESS        
18:06:33    cmd.exe:3564    IRP_MJ_CLOSE     E:\    SUCCESS        
18:06:33    cmd.exe:3564    FASTIO_QUERY_OPEN    E:\test.txt    SUCCES
+S    Attributes: A    
18:06:33    cmd.exe:3564    IRP_MJ_CREATE     E:\    SUCCESS    Option
+s: Open Directory  Access: All    
18:06:33    cmd.exe:3564    IRP_MJ_DIRECTORY_CONTROL    E:\    SUCCESS
+    FileBothDirectoryInformation: test.txt    
18:06:33    cmd.exe:3564    IRP_MJ_CLEANUP    E:\    SUCCESS        
18:06:33    cmd.exe:3564    IRP_MJ_CLOSE     E:\    SUCCESS        
18:06:33    cmd.exe:3564    FASTIO_QUERY_BASIC_INFO    E:\test.txt    
+SUCCESS    Attributes: A    
18:06:33    cmd.exe:3564    FASTIO_QUERY_STANDARD_INFO    E:\test.txt 
+   SUCCESS    Length: 512    
18:06:33    cmd.exe:3564    IRP_MJ_QUERY_INFORMATION    E:\test.txt   
+ SUCCESS    FileNameInformation    
18:06:33    cmd.exe:3564    FASTIO_QUERY_OPEN    E:\test.txt    SUCCES
+S    Attributes: A    
18:06:33    cmd.exe:3564    IRP_MJ_CREATE     E:\    SUCCESS    Option
+s: Open Directory  Access: All    
18:06:33    cmd.exe:3564    IRP_MJ_DIRECTORY_CONTROL    E:\    SUCCESS
+    FileBothDirectoryInformation: test.txt    
18:06:33    cmd.exe:3564    IRP_MJ_CLEANUP    E:\    SUCCESS        
18:06:33    cmd.exe:3564    IRP_MJ_CLOSE     E:\    SUCCESS        
18:06:33    cmd.exe:3564    FASTIO_QUERY_STANDARD_INFO    E:\test.txt 
+   SUCCESS    Length: 512    
18:06:33    cmd.exe:3564    FASTIO_QUERY_STANDARD_INFO    E:\test.txt 
+   SUCCESS    Length: 512    
18:06:33    cmd.exe:3564    IRP_MJ_CLEANUP    E:\test.txt    SUCCESS  
+      
18:06:33    cmd.exe:3564    IRP_MJ_CLOSE     E:\test.txt    SUCCESS   
+     
18:06:33    cmd.exe:3564    FASTIO_QUERY_OPEN    E:\    SUCCESS    Att
+ributes: DHSA    
18:06:33    cmd.exe:3564    FASTIO_QUERY_OPEN    E:\test.txt    SUCCES
+S    Attributes: A    
18:06:33    cmd.exe:3564    FASTIO_QUERY_OPEN    E:\    SUCCESS    Att
+ributes: DHSA    
18:06:33    notepad.exe:4008    IRP_MJ_CREATE     E:    SUCCESS    Opt
+ions: Open  Access: All    
18:06:33    notepad.exe:4008    IRP_MJ_QUERY_VOLUME_INFORMATION    E: 
+   BUFFER OVERFLOW    FileFsVolumeInformation    
18:06:33    notepad.exe:4008    IOCTL: 0x90120    E:    SUCCESS       
+ 
18:06:33    notepad.exe:4008    IRP_MJ_CREATE     E:\    SUCCESS    Op
+tions: Open Directory  Access: All    
18:06:33    notepad.exe:4008    IRP_MJ_DIRECTORY_CONTROL    E:\    SUC
+CESS    FileNamesInformation    
18:06:33    notepad.exe:4008    IRP_MJ_DIRECTORY_CONTROL    E:\    NO 
+MORE FILES    FileNamesInformation    
18:06:33    System:4008    IRP_MJ_CLEANUP    E:\    SUCCESS        
18:06:33    System:4008    IRP_MJ_CLOSE     E:\    SUCCESS        
18:06:33    System:4008    IRP_MJ_CLEANUP    E:    SUCCESS        
18:06:33    System:4008    IRP_MJ_CLOSE     E:    SUCCESS        
18:06:33    notepad.exe:4008    IRP_MJ_CREATE     E:\    SUCCESS    Op
+tions: Open Directory  Access: Traverse    
18:06:33    notepad.exe:4008    FSCTL_IS_VOLUME_MOUNTED    E:\    SUCC
+ESS        
18:06:33    notepad.exe:4008    IRP_MJ_CREATE     E:\    SUCCESS    Op
+tions: Open Directory  Access: All    
18:06:33    notepad.exe:4008    IRP_MJ_DIRECTORY_CONTROL    E:\    SUC
+CESS    FileBothDirectoryInformation: test.txt    
18:06:33    notepad.exe:4008    IRP_MJ_CLEANUP    E:\    SUCCESS      
+  
18:06:33    notepad.exe:4008    IRP_MJ_CLOSE     E:\    SUCCESS       
+ 
18:06:33    notepad.exe:4008    IRP_MJ_CREATE     E:\test.txt    SUCCE
+SS    Options: Open  Access: All    
18:06:33    System:4008    IRP_MJ_CLEANUP    E:    SUCCESS        
18:06:33    notepad.exe:4008    IRP_MJ_CLOSE     E:\test.txt    SUCCES
+S        
18:06:33    notepad.exe:4008    IRP_MJ_QUERY_VOLUME_INFORMATION    E:\
+test.txt    BUFFER OVERFLOW    FileFsVolumeInformation    
18:06:33    notepad.exe:4008    IRP_MJ_QUERY_INFORMATION    E:\test.tx
+t    BUFFER OVERFLOW    FileAllInformation    
18:06:33    notepad.exe:4008    FASTIO_QUERY_STANDARD_INFO    E:\test.
+txt    SUCCESS    Length: 512    
18:06:33    notepad.exe:4008    IRP_MJ_CLEANUP    E:\test.txt    SUCCE
+SS        
18:06:33    notepad.exe:4008    IRP_MJ_CLOSE     E:\test.txt    SUCCES
+S        
18:06:33    System:4    IRP_MJ_QUERY_INFORMATION    E:\test.txt    SUC
+CESS    FileNameInformation    
18:06:33    System:4    IRP_MJ_CREATE     E:    SUCCESS    Options: Op
+en  Access: All    
18:06:33    System:4    IRP_MJ_QUERY_VOLUME_INFORMATION    E:    BUFFE
+R OVERFLOW    FileFsVolumeInformation    
18:06:33    System:4    IRP_MJ_CLEANUP    E:    SUCCESS        
18:06:33    System:4    IRP_MJ_CLOSE     E:    SUCCESS        
18:06:33    notepad.exe:4008    FASTIO_QUERY_OPEN    E:\test.txt    SU
+CCESS    Attributes: A    
18:06:33    notepad.exe:4008    IRP_MJ_CREATE     E:\    SUCCESS    Op
+tions: Open Directory  Access: All    
18:06:33    notepad.exe:4008    IRP_MJ_DIRECTORY_CONTROL    E:\    SUC
+CESS    FileBothDirectoryInformation: test.txt    
18:06:33    notepad.exe:4008    IRP_MJ_CLEANUP    E:\    SUCCESS      
+  
18:06:33    notepad.exe:4008    IRP_MJ_CLOSE     E:\    SUCCESS       
+ 
18:06:35    notepad.exe:4008    IRP_MJ_CLEANUP    E:\    SUCCESS      
+  
18:06:35    notepad.exe:4008    IRP_MJ_CLOSE     E:\    SUCCESS

[download]

I also found this

So, anyone here that can help me out? I'm not sure where to start (and yes, I wanna do this in Perl, using Win32::API or similar I suppose :) ).

Thanks,
Ace

edit: g0n - replaced pre tags with code tags

In reply to File opened/closed in Windows. by Ace128

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.