EldoS | Feel safer!

Software components for data protection, secure storage and transfer

Certain events not firing

Also by EldoS: MsgConnect
Cross-platform protocol-independent communication framework for building peer-to-peer and client-server applications and middleware components.
#9237
Posted: 03/12/2009 06:41:46
by Dan Cooper (Basic support level)
Joined: 06/27/2007
Posts: 125

I'm using the following code to setup a callback on Open, Create, Read, Write and Close events:
Code
m_pCbFlt->AddFilterCallbackRule((LPCWSTR)pPath.ToPointer(), (CallbackFilter::CbFltCallbackFlags)(
CallbackFilter::CbFltCallbackFlags::OpenCallback |
CallbackFilter::CbFltCallbackFlags::CreateCallback |
CallbackFilter::CbFltCallbackFlags::CloseCallback |
CallbackFilter::CbFltCallbackFlags::WriteNotify |
CallbackFilter::CbFltCallbackFlags::ReadNotify));

m_pCbFlt->SetOnOpenFileC(OpenFileEvent);
m_pCbFlt->SetOnCloseFileC(CloseFileEvent);
m_pCbFlt->SetOnReadFileN(ReadFileEvent);
m_pCbFlt->SetOnWriteFileN(WriteFileEvent);
m_pCbFlt->SetOnCreateFileC(CreateFileEvent);


Now this fires my callbacks for Open, Close, and Create but I get nothing for Read or Write. No exception, no callbacks.

Also, I need to implement a watch on Delete operations and there is an entry in the CbFltCallbackFlags for delete notification but no typedef for the function.
#9238
Posted: 03/12/2009 06:50:47
by Daniel Öberg (Standard support level)
Joined: 02/26/2009
Posts: 18

I noticed that Notify and Callbacks not always like each other. Try to use only Callbacks.

The structs are in the CbFlt.h

typedef void (*CbFltCanFileBeDeletedEventC)(
CallbackFilter* Sender,
LPWSTR FileName,
LPBOOL DeleteFile,
PVOID* UserContext,
LPBOOL RequestAccepted
);

typedef void (*CbFltCanFileBeDeletedEventN)(
CallbackFilter* Sender,
LPWSTR FileName
);
#9240
Posted: 03/12/2009 08:55:38
by Dan Cooper (Basic support level)
Joined: 06/27/2007
Posts: 125

I tried the callbacks first which did not work so I then tried the notifications. Neither seem to work for me but only read/write.
#9244
Posted: 03/12/2009 11:36:11
by Vladimir Cherniga (EldoS Corp.)

Quote
Now this fires my callbacks for Open, Close, and Create but I get nothing for Read or Write. No exception, no callbacks.


Could you put here more details how you reproduce the problem ? What is the filter path. What is the apllication that activity you have filtered ?
Some applications, like MS Word, do the modifications on copy of original file, and when document is closed, it just rename the temporary file into original file.
#9245
Posted: 03/12/2009 11:52:27
by Dan Cooper (Basic support level)
Joined: 06/27/2007
Posts: 125

I have since set them all to be Notifications instead of Callbacks.

The path I am using in my test app is "C:\*.txt"

This seems to call all open/close callbacks but not read/write. However, if I remove the "*.txt" and just have "C:\" it seems to call the read/write callbacks as well but for all file types.
#9246
Posted: 03/12/2009 13:05:56
by Vladimir Cherniga (EldoS Corp.)

It means as i thought. The edited file was read/written from its copy, and then renamed from something like *.tmp to your *.txt. Try to interrupt the renameormove event and see if any file was renamed to your *.txt file during closing application.
#9255
Posted: 03/13/2009 02:49:31
by Dan Cooper (Basic support level)
Joined: 06/27/2007
Posts: 125

The file was definitely not renamed to *.tmp. Software like MS Office does this but notepad and UltraEdit overwrite the existing file.
#9259
Posted: 03/13/2009 06:39:27
by Vladimir Cherniga (EldoS Corp.)

So this is happens when file was edited in notepad. I am currently couldn't reproduce such behaviour with FileMon sample. Could you specify in more details how to achieve such erroneous behaviour?
#9260
Posted: 03/13/2009 07:11:36
by Dan Cooper (Basic support level)
Joined: 06/27/2007
Posts: 125

After removing all filters/driver and restarting the machine it seems to be firing correctly so I will keep an eye on it but looks like it may have been an issue on my machine. I can reproduce the problem I mentioned with the file rename having the same name (in the other thread) with the FileMon sample.
Also by EldoS: BizCrypto
Components for BizTalk® and SQL Server® Integration Services that let you securely store and transfer information in your business automation solutions.

Reply

Statistics

Topic viewed 4598 times

Number of guests: 1, registered members: 0, in total hidden: 0




|

Back to top

As of July 15, 2016 EldoS Corporation will operate as a division of /n software inc. For more information, please read the announcement.

Got it!