forum.vdsworld.com

[geicsge]

There is a way to monitor the files\registry changes (create\read\change\delete) made by an application that you selected?

[Garrett]

Yes, you can make a registry monitor and or a file monitor using VDS. In fact, I think I did a registry monitor example on the main site, if you can't find it, let me know and I'll upload it.

I believe it only monitored some key sections in the registry, like the startup entry sections.

I recently did a file monitor also, but! It's not good for say monitoring the entire Windows directory and sub directories. It kind of hits the cpu hard when you try to check that many files, and it's not so quick since there's so many files.

Now, on the other hand, if you're selective about which files to keep an eye on, then yes, VDS would work just fine for that.

[geicsge]

Thank you for your answer, Garrett.
I already saw the GT-RegistryMonitor.dsc example.
Yes, I asked for a true real time reg/files monitor.
I can not interact with any commercial or freeware reg/files monitor (to use it with my VDS applications), in fact only RegMon and FileMon from SysInternals can do the right things, other programms have bugs, do blue screens or have other problems, for example, don't show the PID/proccess who make the file/reg change, so... etc
I don't know in this moment how to build a DLL for VDS or how to monitor API calls.
That's why I asked for help, maybe someone already build a VDS extension...



Regarding registry functions monitoring, the complete list is:

On Windows XP

NtDeleteKey
NtSetValueKey
NtDeleteValueKey
NtSetInformationKey
NtRenameKey
NtEnumerateKey
NtEnumerateValueKey
NtQueryKey
NtQueryValueKey
NtQueryMultipleValueKey
NtCreateKey
NtOpenKey
NtKeyHandleClose

On Windows Server 2003 all of the above and

NtCreateKeyEx
NtOpenKeyEx

On Windows Vista all of the above and

NtFlushKey
NtLoadKey
NtUnLoadKey
NtQuerySecurityKeyInformation
NtSetSecurityKeyInformation

[Garrett]

Well that's not a very big list at all. If VDS has the ability to get you all your information need, I believe it should do just fine.

Best thing to do is to try a few experiments to see if VDS as is will do what you desire.

Also, check out the freeware and shareware dll file sections to see if there are any dll files that might help in you with this project.

Good luck and have fun
~Garrett