EldoS | Feel safer!

Software components for data protection, secure storage and transfer

Certain events not firing

Also by EldoS: CallbackProcess
A component to control process creation and termination in Windows and .NET applications.
#9237
Posted: 03/12/2009 06:41:46
by Dan Cooper (Basic support level)
Joined: 06/27/2007
Posts: 125

I'm using the following code to setup a callback on Open, Create, Read, Write and Close events:
Code
m_pCbFlt->AddFilterCallbackRule((LPCWSTR)pPath.ToPointer(), (CallbackFilter::CbFltCallbackFlags)(
CallbackFilter::CbFltCallbackFlags::OpenCallback |
CallbackFilter::CbFltCallbackFlags::CreateCallback |
CallbackFilter::CbFltCallbackFlags::CloseCallback |
CallbackFilter::CbFltCallbackFlags::WriteNotify |
CallbackFilter::CbFltCallbackFlags::ReadNotify));

m_pCbFlt->SetOnOpenFileC(OpenFileEvent);
m_pCbFlt->SetOnCloseFileC(CloseFileEvent);
m_pCbFlt->SetOnReadFileN(ReadFileEvent);
m_pCbFlt->SetOnWriteFileN(WriteFileEvent);
m_pCbFlt->SetOnCreateFileC(CreateFileEvent);


Now this fires my callbacks for Open, Close, and Create but I get nothing for Read or Write. No exception, no callbacks.

Also, I need to implement a watch on Delete operations and there is an entry in the CbFltCallbackFlags for delete notification but no typedef for the function.
#9238
Posted: 03/12/2009 06:50:47
by Daniel Öberg (Standard support level)
Joined: 02/26/2009
Posts: 18

I noticed that Notify and Callbacks not always like each other. Try to use only Callbacks.

The structs are in the CbFlt.h

typedef void (*CbFltCanFileBeDeletedEventC)(
CallbackFilter* Sender,
LPWSTR FileName,
LPBOOL DeleteFile,
PVOID* UserContext,
LPBOOL RequestAccepted
);

typedef void (*CbFltCanFileBeDeletedEventN)(
CallbackFilter* Sender,
LPWSTR FileName
);
#9240
Posted: 03/12/2009 08:55:38
by Dan Cooper (Basic support level)
Joined: 06/27/2007
Posts: 125

I tried the callbacks first which did not work so I then tried the notifications. Neither seem to work for me but only read/write.
#9244
Posted: 03/12/2009 11:36:11
by Vladimir Cherniga (EldoS Corp.)

Quote
Now this fires my callbacks for Open, Close, and Create but I get nothing for Read or Write. No exception, no callbacks.


Could you put here more details how you reproduce the problem ? What is the filter path. What is the apllication that activity you have filtered ?
Some applications, like MS Word, do the modifications on copy of original file, and when document is closed, it just rename the temporary file into original file.
#9245
Posted: 03/12/2009 11:52:27
by Dan Cooper (Basic support level)
Joined: 06/27/2007
Posts: 125

I have since set them all to be Notifications instead of Callbacks.

The path I am using in my test app is "C:\*.txt"

This seems to call all open/close callbacks but not read/write. However, if I remove the "*.txt" and just have "C:\" it seems to call the read/write callbacks as well but for all file types.
#9246
Posted: 03/12/2009 13:05:56
by Vladimir Cherniga (EldoS Corp.)

It means as i thought. The edited file was read/written from its copy, and then renamed from something like *.tmp to your *.txt. Try to interrupt the renameormove event and see if any file was renamed to your *.txt file during closing application.
#9255
Posted: 03/13/2009 02:49:31
by Dan Cooper (Basic support level)
Joined: 06/27/2007
Posts: 125

The file was definitely not renamed to *.tmp. Software like MS Office does this but notepad and UltraEdit overwrite the existing file.
#9259
Posted: 03/13/2009 06:39:27
by Vladimir Cherniga (EldoS Corp.)

So this is happens when file was edited in notepad. I am currently couldn't reproduce such behaviour with FileMon sample. Could you specify in more details how to achieve such erroneous behaviour?
#9260
Posted: 03/13/2009 07:11:36
by Dan Cooper (Basic support level)
Joined: 06/27/2007
Posts: 125

After removing all filters/driver and restarting the machine it seems to be firing correctly so I will keep an eye on it but looks like it may have been an issue on my machine. I can reproduce the problem I mentioned with the file rename having the same name (in the other thread) with the FileMon sample.
Also by EldoS: Callback File System
Create virtual file systems and disks, expose and manage remote data as if they were files on the local disk.

Reply

Statistics

Topic viewed 5013 times

Number of guests: 2, registered members: 0, in total hidden: 0




|

Back to top

As of July 15, 2016 EldoS Corporation will operate as a division of /n software inc. For more information, please read the announcement.

Got it!