C++钩子与Windows系统恢复点的监控

C++钩子（Hook）是一种用于监控和修改操作系统或应用程序行为的技术

1. 使用C++钩子监控Windows系统恢复点创建过程：

要监控Windows系统恢复点的创建过程，您可以使用RegNotifyChangeKeyValue函数来监听注册表的变化。以下是一个简单的示例：

#include <iostream>
#include <windows.h>

LRESULT CALLBACK HookCallback(int nCode, WPARAM wParam, LPARAM lParam) {
    if (nCode >= 0) {
        if (wParam ==REG_NOTIFY_CHANGE_NAME || wParam == REG_NOTIFY_CHANGE_ATTRIBUTES ||
            wParam == REG_NOTIFY_CHANGE_LAST_WRITE || wParam == REG_NOTIFY_CHANGE_SECURITY) {
            // 注册表发生变化，可能是系统恢复点创建
            std::cout << "System restore point created." << std::endl;
        }
    }
    return CallNextHookEx(NULL, nCode, wParam, lParam);
}

int main() {
    HHOOK hook = SetWindowsHookEx(WH_REGISTRY, HookCallback, NULL, GetCurrentThreadId());
    if (hook == NULL) {
        std::cerr << "Failed to install hook." << std::endl;
        return 1;
    }

    std::cout << "Press Enter to exit the hook..." << std::endl;
    std::cin.get();

    UnhookWindowsHookEx(hook);
    return 0;
}

这个示例使用SetWindowsHookEx函数安装一个钩子，监听注册表的变化。当检测到与系统恢复点相关的注册表项发生变化时，将输出一条消息。

2. 使用C++钩子监控文件系统变化：

要监控文件系统的变化，您可以使用ReadDirectoryChangesW函数。以下是一个简单的示例：

#include <iostream>
#include <windows.h>

void MonitorDirectory(LPCWSTR path) {
    HANDLE hDir = CreateFileW(path, FILE_LIST_DIRECTORY, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OVERLAPPED, NULL);
    if (hDir == INVALID_HANDLE_VALUE) {
        std::cerr << "Failed to open directory: " << path << std::endl;
        return;
    }

    BYTE buffer[1024];
    DWORD bytesReturned;
    OVERLAPPED overlapped = { 0 };
    overlapped.hEvent = CreateEvent(NULL, TRUE, FALSE, NULL);

    while (true) {
        if (ReadDirectoryChangesW(hDir, buffer, sizeof(buffer), TRUE, FILE_NOTIFY_CHANGE_FILE_NAME | FILE_NOTIFY_CHANGE_DIR_NAME | FILE_NOTIFY_CHANGE_ATTRIBUTES | FILE_NOTIFY_CHANGE_SIZE | FILE_NOTIFY_CHANGE_LAST_WRITE | FILE_NOTIFY_CHANGE_CREATION, &bytesReturned, &overlapped)) {
            DWORD bytesTransferred;
            if (GetOverlappedResult(hDir, &overlapped, &bytesTransferred, TRUE)) {
                FILE_NOTIFY_INFORMATION *pNotifyInfo = (FILE_NOTIFY_INFORMATION *)buffer;
                do {
                    std::wstring fileName(pNotifyInfo->FileName, pNotifyInfo->FileNameLength / sizeof(wchar_t));
                    if (fileName == L"." || fileName == L"..") {
                        continue;
                    }

                    if (pNotifyInfo->Action == FILE_ACTION_ADDED || pNotifyInfo->Action == FILE_ACTION_MODIFIED || pNotifyInfo->Action == FILE_ACTION_RENAMED_OLD_NAME) {
                        std::cout << "File system change detected: " << fileName << std::endl;
                    }

                    pNotifyInfo = (FILE_NOTIFY_INFORMATION *)((BYTE *)pNotifyInfo + pNotifyInfo->NextEntryOffset);
                } while (pNotifyInfo->NextEntryOffset != 0);
            }
        }
    }

    CloseHandle(hDir);
    CloseHandle(overlapped.hEvent);
}

int main() {
    std::wstring path = L"C:\\your\\directory";
    MonitorDirectory(path.c_str());
    return 0;
}

这个示例使用CreateFileW函数打开一个目录，并使用ReadDirectoryChangesW函数监控该目录中的文件系统变化。当检测到文件创建、修改或重命名等操作时，将输出一条消息。

请注意，这些示例仅用于演示目的，实际应用中可能需要根据具体需求进行调整。在使用钩子时，请确保遵循最佳实践，以避免对系统性能产生负面影响。