EldoS | Feel safer!

Software components for data protection, secure storage and transfer

OpenFile notification instead of CreateFile when filemonitor winword

Also by EldoS: CallbackDisk
Create virtual disks backed by memory or custom location, expose disk images as disks and more.
#10090
Posted: 05/20/2009 20:24:46
by Wang Sheng (Basic support level)
Joined: 02/16/2009
Posts: 44

When I use your sample:Filemon to monitor winword.exe,
when winword.exe create a new doc file,
OpenFile notification instead of CreateFile .

why.
#10094
Posted: 05/21/2009 02:57:38
by Vladimir Cherniga (EldoS Corp.)

The problem is in the way the CreateFile() win32 api works. When application requests for new file creation it don't know if the file with the same name already exist or not. For such cases CreateDisposition parameter regulate file system behaviour during creation/opening file. When this parameter value is not clear "Create new file" we suppose that file *may* be already exist and invoke Open File callback. You can read another threads from this forum associated with this problem: http://www.eldos.com/forum/read.php?P...av_start_2
http://www.eldos.com/forum/read.php?FID=14&TID=1792

Reply

Statistics

Topic viewed 2755 times

Number of guests: 1, registered members: 0, in total hidden: 0




|

Back to top

As of July 15, 2016 EldoS Corporation will operate as a division of /n software inc. For more information, please read the announcement.

Got it!