如何拦截windows NT/windows2000下的所有文件操作

[pbdesigner]

[black_fox]

这有个VB的例子。我一时找不到这个api在哪个库了。呵呵。你到MSDN中看hook那一单元吧。
Private Const FILE_NOTIFY_CHANGE_ATTRIBUTES = &H4
Private Const FILE_NOTIFY_CHANGE_DIR_NAME = &H2
Private Const FILE_NOTIFY_CHANGE_FILE_NAME = &H1
Private Const FILE_NOTIFY_CHANGE_SIZE = &H8
Private Const FILE_NOTIFY_CHANGE_LAST_WRITE = &H10
Private Const FILE_NOTIFY_CHANGE_SECURITY = &H100
Private Const FILE_NOTIFY_CHANGE_ALL = &H4 Or &H2 Or &H1 Or &H8 Or &H10 Or &H100
Private Declare Function FindFirstChangeNotification Lib "kernel32" Alias "FindFirstChangeNotificationA" (ByVal lpPathName As String, ByVal bWatchSubtree As Long, ByVal dwNotifyFilter As Long) As Long
Private Declare Function FindCloseChangeNotification Lib "kernel32" (ByVal hChangeHandle As Long) As Long
Private Declare Function FindNextChangeNotification Lib "kernel32" (ByVal hChangeHandle As Long) As Long
Private Declare Function WaitForSingleObject Lib "kernel32" (ByVal hHandle As Long, ByVal dwMilliseconds As Long) As Long
Private Declare Function ResetEvent Lib "kernel32" (ByVal hEvent As Long) As Long
Private Sub Form_Load()
Dim Ret As Long
Ret = FindFirstChangeNotification("C:\", &HFFFFFFFF, FILE_NOTIFY_CHANGE_ALL)
WaitForSingleObject Ret, &HFFFFFFFF
MsgBox "Event Triggered for the first time"
FindNextChangeNotification Ret
WaitForSingleObject Ret, &HFFFFFFFF
MsgBox "Event Triggered for the second time"
'Remove our hook
FindCloseChangeNotification Ret
End Sub

[prog_st]

拷贝钩子

[pbdesigner]

up