How to observe made Windows System Changes by a Program - windows

I just came up with a Question thats bugging me.
I would like to create or find a Program that can observe filesystem changes and registry etc. Changes made by another Executable.
Like Starting a Program through Another and observing the windows api calls or something.
Is that possible? And how would I go about it?
Thanks in advance.

You can use this api http://msdn.microsoft.com/en-us/library/windows/desktop/aa365261(v=vs.85).aspx
This api is limited and if your task is out of scope of this api you must go in minifilter driver wonderland.

Related

Change Display Resolution from Windows Service (Windows 7)

( Hi, everyone. I'm very new to Windows programming, so I apologize in advance if this has already been asked and I just didn't know what to search for, but this problem has been driving me crazy and I know someone could probably answer this really easily. )
My company has an application that runs as a service in Windows 7. I have been tasked with writing code to change display settings, but I apparently cannot do this from a system service. I created a small executable that changes the color depth to 8bpp in about 5-10 lines of code, but when I place this code in my application, it returns success yet does not actually succeed (nothing changes).
Without a commanding knowledge of how Windows programming works, I have managed to try a MILLION different things to get it to work but with no avail. Can somebody PLEASE help me find what I need to do to make this code function?
On Vista and upwards services run in a different session (session 0) and are isolated from the interactive desktop(s). This means that code that you run from the service is simply unable to make the changes you want. The obvious conclusion is that you need to run code in the interactive desktop.
Now you can do this, but it's not exactly easy to achieve. What you will need to do is arrange for your service to launch an process that runs on the interactive desktop: Launching an interactive process from Windows Service in Windows Vista and later. That process, rather than the service, is what will have to make the changes.
Whilst it is possible to achieve what you want, I think you should regard the difficulties involved as a signal to review whether or not your proposed approach is the best solution to whatever your underlying problem is.

Tracking changes in a directory programmacticaly

I have to write a litle app that will process files saved in a given dir. I doesn´t pleases me the idea of writing infinite loops, timers and that kind of stuff.
I´d like to know if there if (I would bet a finger that there is!) there is any windows API that would send my app a message for any file saved in that given dir.
ReadDirectoryChangesW is non-trivial to use correctly. There is a working sample here. I have worked with production code closely derived from this, and I've found no better sample to work from.
Note that there are known issues with the API (admittedly corner cases that may not affect you) that are described here and here, and further suggestions on usage here.
The function you're looking for is ReadDirectoryChangesW.
you can use the FindFirstChangeNotification funciton too. Exist an component called TJvChangeNotify from the JEDI JVCL collection wich encapsules this function which makes it easier to use.

Vb6 application works in the IDE but the executable crashes

I have a little problem with visual basic 6 project. Everything works fine in the IDE
but the executable crashes every time, when I run the application. The application uses callbacks to communicate with a C++ dll. Even code as simple as showing a message box fails when the callback starts.
I changed the compilation mode to P-Code and still the problem persist.
Any help would be appreciate.
Thank you all
This sounds like the callbacks may be occurring on a different thread than your application is executing on. [EDIT: As I see Jim has already suggested.] If that's the case, yeah, kaboom just as soon as you "touch" anything OLE related or call into the runtime. Same story as with multimedia timer callbacks, fwiw, and I'd suspect you'll have to take the same precautions as one would with those if this is the case.
The short story with different thread callbacks is that you'll need to post a message to yourself, using PostMessage declared in a typelib so that the Err object isn't set by VB, then let the callback return. You do your own processing on receipt of the posted message. Here's the typelib I used for this with the CCRP Timers library:
http://vb.mvps.org/tools/files/postmessage.zip
Hope that helps...
Who's calling back to whom? Show us a little code.
The IDE can mask real problems, so just being able to run there is no guarantee that what you're doing is supported.
One common problem with callbacks is that VB6's runtime is not thread-safe, so if another thread is calling back into your VB code, you can't do anything that will invoke the runtime -- like access strings or objects.
There are ways around some of these issues, but I think we need to know more first.
Is the code being run from the same location as the IDE? Likely it is a reference problem, and you need to re-register the DLL.
A deployment package should make sure you have everything installed.
A few questions:
Is the executable on the same PC as it was developed, or a different one?
Does the file use a manifest file? If so, does mainfest call XP themes?
Also, if using manifest, does manifest use SXS for OCX files?

Can I use svchost.exe to host my own services?

I can't find documentation for how to do it, which makes me think I'm not supposed to do it.
No, svchost.exe is undocumented and only supported for services that are part of Windows.
Part of the reason is reliability - a crash in a 3rd party service should have no effect on a critical Windows service.
Why do you want to use svchost? Do you have several services that you want to combine together? Creating your own exe to host multiple services is pretty straightforward.
Comment in this link will help you out, its too much to cut/paste here. Source is C++ as you didn't specify a language I dont think it will matter.
The Link
EDIT: For the record, I am not saying it's a good idea.
You can download the windows NT resource kit (http://www.microsoft.com/downloads/details.aspx?familyid=9d467a69-57ff-4ae7-96ee-b18c4790cffd&displaylang=en), and follow these instructions to create a service out of anything: http://support.microsoft.com/kb/137890

Making a windows program thumbdrive portable

I am currently trying to make an application portable.
Where are the common places that an application puts its settings in a windows machine?
do you know know of any other places besides
-registry
-Currentuser/Application Data
-app folder
?
After you go over all the places you could think of, try running your app with Process Monitor in the background. Using the right filters, it will show you which registry keys and files have been accessed. And, it will show the exact stack trace of every operation, so you won't have a hard time finding the source of those calls.
Just for completeness - There are a couple of places within the registry (current-user and local-machine).
It depends how the developer stored it.
As sean has said in comment, this also depends on the application framework and windows version. (Thanks sean)

Resources