Detect file access

[MrCreatoR]

I am using this script:

expandcollapse popup

#include "WinAPIEx.au3"

$sFile = @DesktopDir & '\~Test'
DirCreate($sFile)

$hBlock = _BlockFile($sFile)

ShellExecute($sFile)
MsgBox(262144+64, @ScriptName, 'Trying to open file:' & @CRLF & @CRLF & $sFile & @CRLF & @CRLF & '...')

_UnBlockFile($hBlock)

DirRemove($sFile)

Func _BlockFile($sFile, $iShowErrMsg = 1)
    If Not FileExists($sFile) Then
        Return SetError(1, 0, -1)
    EndIf
    
    Local $hFile = _WinAPI_CreateFileEx($sFile, $OPEN_EXISTING, BitOR($GENERIC_READ, $GENERIC_WRITE), 0, _WinAPI_PathIsDirectory($sFile) ? $FILE_FLAG_BACKUP_SEMANTICS : 0)
    
    If @error Or $hFile = -1 Then
        If $iShowErrMsg Then
            If _WinAPI_PathIsDirectory($sFile) Then
                MsgBox(48, 'Error', 'Unable To Block The Folder')
            Else
                MsgBox(48, 'Error', 'Unable To Block The File')
            EndIf
        EndIf
        
        Local $iFileInUse = 0
        
        If _WinAPI_GetLastError() = 32 Then ; ERROR_SHARING_VIOLATION
            $iFileInUse = 1
        EndIf
        
        Return SetError(1, $iFileInUse, $hFile)
    EndIf
    
    Return $hFile
EndFunc

Func _UnBlockFile($hBlock)
    _WinAPI_CloseHandle($hBlock)
EndFunc

I need to be able to detect when this blocked file/folder was opened/accessed (user have tried to open the file), and then display some message with info about blocked object (folder or file). Preferably, i should be able to depress the user's action (so the system message box will not be displayed).

Any ideas?

Edited July 3, 2015 by MrCreatoR

[MrCreatoR]

*Up*

[JohnOne]

Not sure what you mean.

When I run this script, the file is not allowed to be opened, is that correct behaviour?

[mLipok]

Maybe this:

 

[MrCreatoR]

Not sure what you mean.

When I run this script, the file is not allowed to be opened, is that correct behaviour?

Yes this is the correct behavior, the script is working.

I explained all what i need in the first post:

I need to be able to detect when this blocked file/folder was opened/accessed (user have tried to open the file)

So after i use the script above, the file is locked, and after that, if user tries to open this file, the associated program will popup an error message (file can not be opened). So i need to "catch" this event from my script.

[MrCreatoR]

Maybe this:

 

Thanks but no, it can not monitor such events (file/folder opening/accessing).

[MrCreatoR]

*Up*

[Danyfirex]

maybe this helps.

 

Saludos

[JohnOne]

I believe that only notifies of changes, not accesses.

In lieu of definite answers, I'll make a couple of suggestions you could consider.

1. Hook the shell and get notified of new window creation, examine window information.

2. I've been looking at event tracing (search "ETW") which is interesting, and might be worth your while looking into. The relevant gist of it is that you can monitor events in real time, even from the kernel which is an event provider, you would be an event consumer. I'm uncertain how or if you could use this in autoit (i'm using in other) or if file access is an event the kernel will 'broadcast' (for want of a better word) but I'm pretty sure it will be, so worth a look. I must warn that good solid examples are few and far between, and the documentation is vast, fragmented, and often conflicting. So I'd advise it only if you are really determined.

EDIT:

The library used in C++ is OS dependent, in win 7 the functions are in Advapi32.dll.

Edited August 20, 2015 by JohnOne
typo

[Danyfirex]

@JohnOne I meant using this flags FILE_NOTIFY_CHANGE_LAST_WRITE and FILE_NOTIFY_CHANGE_SIZE

Saludos

Edited August 16, 2015 by Danyfirex

[JohnOne]

MrCreatoR want's to know when someone tries to even just read the file you see, not just write to or otherwise alter it.

[Danyfirex]

mmm I see. So I could be done with JohnOne's  tip about using shellhook.

Another altenative is use SetWinEventHook with EVENT_SYSTEM_DIALOGSTART flag to detect when dialog appear (dalog saying Location unavailable or whatever it says depend of OS language)

 

Saludos

Edited August 16, 2015 by Danyfirex
Edit

[MilesAhead]

A cheesy way may be to watch the active window for those of class "#32770" which is just about any dialog that isn't really a windows form made to look like a dialog box.