protectdrv.cpp

以filemon开源代码为模板

#include "StdAfx.h"
#include "ProtectDrv.h"

CProtectDrv::CProtectDrv(LPCTSTR driveName,LPCTSTR sysPath)
:CLoadDrv(driveName,sysPath)
{
}

CProtectDrv::~CProtectDrv(void)
{
}

BOOL CProtectDrv::StartFilter()
{	
	FILTER FilterDefinition;
	strcpy(FilterDefinition.includefilter, "*.*");
	FilterDefinition.excludefilter[0] = '\0';
	FilterDefinition.logreads = TRUE;
	FilterDefinition.logwrites = TRUE;
	DWORD nb;

	if ( ! DeviceIoControl(	m_sysHandle, IOCTL_FILEMON_SETFILTER,
		&FilterDefinition, sizeof(FILTER), NULL, 
		0, &nb, NULL ) ) 
		return (FALSE);

	if(! DeviceIoControl(m_sysHandle,IOCTL_FILEMON_STARTFILTER,
		NULL,0,NULL,
		0,&nb,NULL))
	{
		return FALSE;
	}
	else
	{
		return TRUE;
	}
}