Sign in to follow this  
Followers 0
Skitty

File Change Monitoring

2 posts in this topic

#1 ·  Posted (edited)

1st of all, I know there are other ways of doing this via dll calls, but I was just wondering why you can't do this like this?

$Obj2 = ObjGet("winmgmts:{impersonationLevel=impersonate}!\\" & @ComputerName & "\root\cimv2")
$S2 = ObjCreate("WbemScripting.SWbemSink")
If Not IsObj($Obj2) And IsObj($S2) Then Exit MsgBox(0,"","Could not aquire object handle.")
ObjEvent($S1,"SINK2_")
$Obj2.ExecNotificationQueryAsync($S2, "Select * From __InstanceCreationEvent Within 5 Where " _
    & "Targetinstance Isa 'CIM_DataFile' and " _
    & "TargetInstance.Drive= 'Win32_Directory.Name=C:\\\\Documents and Settings\\\\TEST\\\\Desktop'")
While 1
Sleep(500)
Wend
Func SINK2_OnObjectReady($OB)
    Switch $OB.Path_.Class
        Case "__InstanceCreationEvent"
            MsgBox(0,"","A new file was just created: " & $OB.TargetInstance.PartComponent,1)
        Case "__InstanceDeletionEvent"
            MsgBox(0,"","A file was just deleted: " & $OB.
TargetInstance.PartComponent,1)
    EndSwitch
EndFunc

I get an error with $OB.TargetInstance.PartComponent but I don't If I use the VBS version, that doesn't quite operate through a notification like this autoit object version.

I just learned what objects are so give me some slack.

Although, I got these to work just fine-

$Obj0 = ObjGet("winmgmts:{impersonationLevel=impersonate}!\\" & @ComputerName & "\root\cimv2")
$S0 = ObjCreate("WbemScripting.SWbemSink")
If Not IsObj($Obj0) And IsObj($S0) Then Exit MsgBox(0,"","Could not aquire object handle.")
ObjEvent($S0,"SINK0_")
$Obj0.ExecNotificationQueryAsync($S0, "SELECT * FROM __InstanceOperationEvent WITHIN 0.1 WHERE TargetInstance ISA 'Win32_Process'")
$Obj1 = ObjGet("winmgmts:{impersonationLevel=impersonate}!\\" & @ComputerName & "\root\cimv2")
$S1 = ObjCreate("WbemScripting.SWbemSink")
If Not IsObj($Obj1) And IsObj($S1) Then Exit MsgBox(0,"","Could not aquire object handle.")
ObjEvent($S1,"SINK1_")
$Obj1.ExecNotificationQueryAsync($S1, "SELECT * FROM __InstanceOperationEvent WITHIN 0.1 WHERE TargetInstance ISA 'Win32_LogicalDisk'")
While 1
Sleep(500)
Wend
Func SINK0_OnObjectReady($OB)
Switch $OB.Path_.Class
  Case "__InstanceCreationEvent"
   ;$OB.TargetInstance.Terminate
   MsgBox(0,"Initiated",$OB.TargetInstance.Name,1)
  Case "__InstanceDeletionEvent"
   MsgBox(0,"Terminated",$OB.TargetInstance.Name,1)
EndSwitch
EndFunc
Func SINK1_OnObjectReady($OB)
If $OB.TargetInstance.DriveType = 2 Then
        Select
            Case $OB.Path_.Class()="__InstanceCreationEvent"
    MsgBox(0,"Inserted",$OB.TargetInstance.DeviceId&"\",1)
            Case $OB.Path_.Class()="__InstanceDeletionEvent"
    MsgBox(0,"Removed",$OB.TargetInstance.DeviceId&"\",1)
        EndSelect
    EndIf
EndFunc

Edit: What happened to the [AutoIt] tags?

Edited by THAT1ANONYMOUSEDUDE

Things that I've done..

Icon Resource Editor: icon resource editor 

AutoIt Piano: a piano

AutoIt Unlocker: unlocks files when you want to delete them

Colorful tooltips: a wrapper for the tool tips UDF

Rouge GoogleBot: a full screen animation

ASciTE text editor: a text editor written in autoit

Warning: Posts by this user are subject to change or may disappear without notice.

Share this post


Link to post
Share on other sites



1. This has all the info you need about what happened to the forum.

2. Why not monitor the directory size and when it changes then compare the file sizes and names to their last known info?


My UDFs are generally for me. If they aren't updated for a while, it means I'm not using them myself. As soon as I start using them again, they'll get updated.

MY PROJECTS


Active: IRC UDF, WindowEx UDF
Discontinued: GithubBubbleSort UDF

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0