And inside the folder has modified, folder m_time, c_time did not change, can you tell me whether there are other methods to monitor folder inside be modified? Or get the folder size method?
CodePudding user response:
In the Windows file monitoring there are three ways, the first is "virtual file system driver" methods, such as filemon under Windows, there are many online about his analysis, the second method is to "HOOK API method, HOOK technology, and the third way is" messaging ", notification messages from the Windows file system for file operations, but this is after the completion of the file operations, to inform, so can only monitor surveillance, cannot be completely controlled, and message mechanism, there are three methods, (1) through the use of "not open API SHChangeNotifyRegister realize"; (2) by FindFirstChangeNotification; (3) through the ReadDirectoryChangesW implementation, (2) (3) methods for only one in the specified directory or subdirectory of the changes in line with the filter conditions, monitor,This document is aimed at SHChangeNotifyRegister file monitoring methods are detailed introduction, main reference site:
http://hi.baidu.com/bees007/blog/item/994c693498251442251f14ea.html
http://it.chinawin.net/softwaredev/article-745f.html
http://msdn.microsoft.com/en-us/library/bb762120 (vs. 85). Aspx
http://msdn.microsoft.com/en-us/library/bb762119 (vs. 85). Aspx
Windows inside have two undisclosed function (note: in the latest MSDN, has released the two functions), called SHChangeNotifyRegister and SHChangeNotifyDeregister respectively, can achieve the above functions, these two functions in Shell32. DLL, with the serial number is derived, which is why we use VC built-in tools Depends upon the Shell32. DLL, can not find the reason of these two functions, SHChangeNotifyRegister export serial number is 2; And SHChangeNotifyDeregister export serial number is 4,
(1) function SHChangeNotifyRegister
SHChangeNotifyRegister is mainly used for the specified window is added to the system message monitoring in the chain, then the window will receive notifications from the file system or Shell,
SHChangeNotifyRegister MSDN official address:
http://msdn.microsoft.com/en-us/library/bb762120 (vs. 85). Aspx
SHChangeNotifyRegister prototype and related parameters are as follows:
ULONG SHChangeNotifyRegister
(
The HWND HWND,
Int fSources,
LONG fEvents,
UINT wMsg,
Int cEntries,
SHChangeNotifyEntry * pfsne
);
Among them:
HWND: that will receive change or notification message window handle,
FSource: indicates the event types, receives the message will be one of the following values of one or more (note: these marks are not included in any header file, the user must be defined in their own applications or directly using the corresponding numerical)
SHCNRF_InterruptLevel: 0 x0001, receive interrupt level from a file system notification messages,
SHCNRF_ShellLevel: 0 x0002, received from the Shell Shell level notification messages,
SHCNRF_RecursiveInterrupt: 0 x1000, receive catalogs all subdirectories under disruption events, this flag must be used and SHCNRF_InterruptLevel logo together, when using this flag, also need to set up the corresponding SHChangeNotifyEntry fRecursive member of the structure to TRUE (the structure by the function of the last parameter pfsne point), such notification message in the directory tree is recursive,
SHCNRF_NewDelivery: 0 x8000, received message using Shared memory, you must first call SHChangeNotification_Lock, and then you can access the actual data, after the completion of the SHChangeNotification_Unlock function called free memory,
FEvents: to capture events, see the MSDN for all possible values in the annotations about SHChangeNotify function,
http://msdn.microsoft.com/en-us/library/bb762118 (vs. 85). Aspx
SHCNE_ALLEVENTS: all events,
SHCNE_ASSOCCHANGED: change file associations,
SHCNE_ATTRIBUTES: file attributes change,
SHCNE_CREATE: file creation
SHCNE_DELETE: file delete
SHCNE_DRIVEADD: add drive
SHCNE_DRIVEADDGUI: Windows XP and later: Not 2.
SHCNE_DRIVEREMOVED: remove drive
SHCNE_EXTENDED_EVENT: Not currently 2.
SHCNE_FREESPACE: disk space size change
SHCNE_MEDIAINSERTED: insert the removable storage medium
SHCNE_MEDIAREMOVED: remove the removable storage medium
SHCNE_MKDIR: new directory
SHCNE_NETSHARE: change directory Shared property
SHCNE_NETUNSHARE: directory does not share
SHCNE_RENAMEFOLDER: rename folder
SHCNE_RENAMEITEM: rename files
SHCNE_RMDIR: delete the directory
SHCNE_SERVERDISCONNECT: The computer has gone from a server.
SHCNE_UPDATEDIR:
SHCNE_UPDATEIMAGE:
SHCNE_UPDATEITEM: update file,
SHCNE_DISKEVENTS:
SHCNE_GLOBALEVENTS:
SHCNE_INTERRUPT:
WMsg: produce the corresponding incident, messages sent to a window, pay attention to the news is our definition, so need to avoid repeating, and system definition system of the message list as specified in the following two pages:
http://www.cnblogs.com/highmayor/archive/2008/01/16/1041701.html
http://www.cnblogs.com/highmayor/archive/2008/01/16/1041698.html
CEntries: pfsne points to an array of the number of members,
Pfsne: SHChangeNotifyEntry structure array pointer to the starting, the structure bearing notification messages, number of its members must be set to 1, otherwise SHChangeNotifyRegister or SHChangeNotifyDeregister will not work properly,
If the function call is successful, it returns an integer number registered mark, otherwise it returns 0, at the same time, system will be HWND specified window into the monitoring in the chain operation, when there is a file operations occurs, the system will be sent to the window HWND logo wMsg specified message, as long as we join in the program of the message processing function can be achieved on the system operation monitoring,
(2) SHChangeNotifyDeregister function
SHChangeNotifyDeregister function is mainly used to cancel monitoring hook, if you want to exit the program monitoring, are called SHChangeNotifyDeregister to cancel process monitoring,
SHChangeNotifyDeregister MSDN official address:
http://msdn.microsoft.com/en-us/library/bb762119 (vs. 85). Aspx
SHChangeNotifyDeregister function prototype is as follows:
BOOL SHChangeNotifyDeregister (ULONG ulID);
Should cancel the ulID specifies the monitoring of registered mark, if uninstall success, return TRUE, otherwise it returns FALSE,
(3) in Visual studio 2005, XP system implementation:
At http://it.chinawin.net/softwaredev/article-745f.html have lists of a very good example, it first loading the loading Shell32. DLL and initialization function pointer moves, then call register register functions with Shell, however, I found, when implemented as long as you include the header file, you can call the two functions of the above, no need to load Shell32. DLL, it made some simplified code, (at the moment, I also don't know whether this method I have limitations, welcome to put forward valuable opinion for me,)
The core code block:
Statement macros and some is not defined structure (must) :
/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
/* ShellDef: at the same time to add some macro and structure definition */
/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
# include
# define SHCNRF_InterruptLevel 0 x0001//Interrupt level notifications from the file system
# define SHCNRF_ShellLevel 0 x0002//Shell - level notifications from the Shell
# define SHCNRF_RecursiveInterrupt 0 x1000//Interrupt events on the whole subtree
# define SHCNRF_NewDelivery 0 x8000//Messages received use Shared memorytypedef struct
Typedef struct _FILECHANGEINFO
{
DWORD dwItem1;//dwItem1 contains the previous PIDL or the name of the folder.
DWORD dwItem2;//dwItem2 contains the new PIDL or the name of the folder.
} FILECHANGEINFO; nullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnull