C++鉤子與Windows系統恢復點的監控

C++鉤子（Hook）是一種用于監控和修改操作系統或應用程序行為的技術

1. 使用C++鉤子監控Windows系統恢復點創建過程：

要監控Windows系統恢復點的創建過程，您可以使用RegNotifyChangeKeyValue函數來監聽注冊表的變化。以下是一個簡單的示例：

#include <iostream>
#include <windows.h>

LRESULT CALLBACK HookCallback(int nCode, WPARAM wParam, LPARAM lParam) {
    if (nCode >= 0) {
        if (wParam ==REG_NOTIFY_CHANGE_NAME || wParam == REG_NOTIFY_CHANGE_ATTRIBUTES ||
            wParam == REG_NOTIFY_CHANGE_LAST_WRITE || wParam == REG_NOTIFY_CHANGE_SECURITY) {
            // 注冊表發生變化，可能是系統恢復點創建
            std::cout << "System restore point created." << std::endl;
        }
    }
    return CallNextHookEx(NULL, nCode, wParam, lParam);
}

int main() {
    HHOOK hook = SetWindowsHookEx(WH_REGISTRY, HookCallback, NULL, GetCurrentThreadId());
    if (hook == NULL) {
        std::cerr << "Failed to install hook." << std::endl;
        return 1;
    }

    std::cout << "Press Enter to exit the hook..." << std::endl;
    std::cin.get();

    UnhookWindowsHookEx(hook);
    return 0;
}

這個示例使用SetWindowsHookEx函數安裝一個鉤子，監聽注冊表的變化。當檢測到與系統恢復點相關的注冊表項發生變化時，將輸出一條消息。

2. 使用C++鉤子監控文件系統變化：

要監控文件系統的變化，您可以使用ReadDirectoryChangesW函數。以下是一個簡單的示例：

#include <iostream>
#include <windows.h>

void MonitorDirectory(LPCWSTR path) {
    HANDLE hDir = CreateFileW(path, FILE_LIST_DIRECTORY, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OVERLAPPED, NULL);
    if (hDir == INVALID_HANDLE_VALUE) {
        std::cerr << "Failed to open directory: " << path << std::endl;
        return;
    }

    BYTE buffer[1024];
    DWORD bytesReturned;
    OVERLAPPED overlapped = { 0 };
    overlapped.hEvent = CreateEvent(NULL, TRUE, FALSE, NULL);

    while (true) {
        if (ReadDirectoryChangesW(hDir, buffer, sizeof(buffer), TRUE, FILE_NOTIFY_CHANGE_FILE_NAME | FILE_NOTIFY_CHANGE_DIR_NAME | FILE_NOTIFY_CHANGE_ATTRIBUTES | FILE_NOTIFY_CHANGE_SIZE | FILE_NOTIFY_CHANGE_LAST_WRITE | FILE_NOTIFY_CHANGE_CREATION, &bytesReturned, &overlapped)) {
            DWORD bytesTransferred;
            if (GetOverlappedResult(hDir, &overlapped, &bytesTransferred, TRUE)) {
                FILE_NOTIFY_INFORMATION *pNotifyInfo = (FILE_NOTIFY_INFORMATION *)buffer;
                do {
                    std::wstring fileName(pNotifyInfo->FileName, pNotifyInfo->FileNameLength / sizeof(wchar_t));
                    if (fileName == L"." || fileName == L"..") {
                        continue;
                    }

                    if (pNotifyInfo->Action == FILE_ACTION_ADDED || pNotifyInfo->Action == FILE_ACTION_MODIFIED || pNotifyInfo->Action == FILE_ACTION_RENAMED_OLD_NAME) {
                        std::cout << "File system change detected: " << fileName << std::endl;
                    }

                    pNotifyInfo = (FILE_NOTIFY_INFORMATION *)((BYTE *)pNotifyInfo + pNotifyInfo->NextEntryOffset);
                } while (pNotifyInfo->NextEntryOffset != 0);
            }
        }
    }

    CloseHandle(hDir);
    CloseHandle(overlapped.hEvent);
}

int main() {
    std::wstring path = L"C:\\your\\directory";
    MonitorDirectory(path.c_str());
    return 0;
}

這個示例使用CreateFileW函數打開一個目錄，并使用ReadDirectoryChangesW函數監控該目錄中的文件系統變化。當檢測到文件創建、修改或重命名等操作時，將輸出一條消息。

請注意，這些示例僅用于演示目的，實際應用中可能需要根據具體需求進行調整。在使用鉤子時，請確保遵循最佳實踐，以避免對系統性能產生負面影響。