Title really says it all. I am trying to figure out a way to list all the files the have been modified or created even deleted through a specific process. I am attempting to accomplish this via C# any help is greatly appriciated.
|
.NET
C# Grab names of files created and modified by specific process |
 (Feb 19, 2019 05:04 AM)-PUBG- Wrote: Title really says it all. I am trying to figure out a way to list all the files the have been modified or created even deleted through a specific process. I am attempting to accomplish this via C# any help is greatly appriciated. I would suggest this: https://stackoverflow.com/questions/4350...om-windows  (Feb 19, 2019 11:29 AM)Abruptum Wrote: I would suggest this: https://stackoverflow.com/questions/4350...om-windows Not even close to the right answer. This doesn't detect what process created/modified the file and it is also directory specific... You'd have to hook file writing methods within the target process, and that is the only real answer here.
Getting Started: C/C++
[C/C++/.NET/x86 ASM - Automation Programmer] (Feb 19, 2019 03:39 PM)0xDEAD10CC Wrote: Not even close to the right answer. This doesn't detect what process created/modified the file and it is also directory specific... You'd have to hook file writing methods within the target process, and that is the only real answer here. Yes, you are right o.O seems like i totally misunderstood the question :/ Can you provide any source for your method ? i want to know how it can be done. If proper created can it detect files changes runned through process chains ? Really interesting topic. (Feb 20, 2019 10:34 AM)Abruptum Wrote: Yes, you are right o.O seems like i totally misunderstood the question :/ Your hooks on functions like NtCreateFile, etc would indicate the changes, and would be applicable to the process you've created the hooks for.
Getting Started: C/C++
[C/C++/.NET/x86 ASM - Automation Programmer] |
|
|
