Hi all,
I previously had a question about detecting file changes. After reading the
answers to my post as well as some older messages, I need to slightly
rephrase. Most had suggested to catch IRP_MJ_CREATE with the following flag
combo:
Either:
if ( ((DesiredAccessFlags & (FILE_WRITE_DATA | // 0x0002
FILE_WRITE_ATTRIBUTES | // 0x0100
FILE_WRITE_EA | // 0x0010
FILE_APPEND_DATA | // 0x0004
DELETE | // 0x00010000
WRITE_DAC | // 0x00040000
WRITE_OWNER)) || // 0x00080000
(createDisposition != FILE_OPEN) || // Modes 0 & 2-5
(CreationOptions & FILE_DELETE_ON_CLOSE)) ) { // 0x00001000
{ WRITE DEETECTED }
or
DesiredAccess
=Data->Iopb->Parameters.Create.SecurityContext->DesiredAccess;
if (FlagOn( DesiredAccess, DELETE | FILE_WRITE_DATA |FILE_APPEND_DATA )
{WRITE DETECTED}
But in both approaches a single write to a file will detect a write multiple
times (I have seen it anywhere between 2-5 times, depending on the
application ( I was looking at notepad and MS office products e.g. word,
ppt, visio). Based on one write from user level I really would want to do
some action only once as well. I was thinking I could maybe try to catch a
write to the changetime field instead. But I am not sure when that is
written. Or is there another way to detect a single write only once? So far
we have been looking at certain sequences for the various apps to detect a
write unambigously, but that makes it very appliction-dependent. We would
rather like to find a generic approach.
Thanks, bjorn