C++鉤子與Windows系統(tǒng)恢復(fù)點(diǎn)的監(jiān)控

C++鉤子（Hook）是一種用于監(jiān)控和修改操作系統(tǒng)或應(yīng)用程序行為的技術(shù)

1. 使用C++鉤子監(jiān)控Windows系統(tǒng)恢復(fù)點(diǎn)創(chuàng)建過程：

要監(jiān)控Windows系統(tǒng)恢復(fù)點(diǎn)的創(chuàng)建過程，您可以使用RegNotifyChangeKeyValue函數(shù)來監(jiān)聽注冊(cè)表的變化。以下是一個(gè)簡單的示例：

#include <iostream>
#include <windows.h>

LRESULT CALLBACK HookCallback(int nCode, WPARAM wParam, LPARAM lParam) {
    if (nCode >= 0) {
        if (wParam ==REG_NOTIFY_CHANGE_NAME || wParam == REG_NOTIFY_CHANGE_ATTRIBUTES ||
            wParam == REG_NOTIFY_CHANGE_LAST_WRITE || wParam == REG_NOTIFY_CHANGE_SECURITY) {
            // 注冊(cè)表發(fā)生變化，可能是系統(tǒng)恢復(fù)點(diǎn)創(chuàng)建
            std::cout << "System restore point created." << std::endl;
        }
    }
    return CallNextHookEx(NULL, nCode, wParam, lParam);
}

int main() {
    HHOOK hook = SetWindowsHookEx(WH_REGISTRY, HookCallback, NULL, GetCurrentThreadId());
    if (hook == NULL) {
        std::cerr << "Failed to install hook." << std::endl;
        return 1;
    }

    std::cout << "Press Enter to exit the hook..." << std::endl;
    std::cin.get();

    UnhookWindowsHookEx(hook);
    return 0;
}

這個(gè)示例使用SetWindowsHookEx函數(shù)安裝一個(gè)鉤子，監(jiān)聽注冊(cè)表的變化。當(dāng)檢測到與系統(tǒng)恢復(fù)點(diǎn)相關(guān)的注冊(cè)表項(xiàng)發(fā)生變化時(shí)，將輸出一條消息。

2. 使用C++鉤子監(jiān)控文件系統(tǒng)變化：

要監(jiān)控文件系統(tǒng)的變化，您可以使用ReadDirectoryChangesW函數(shù)。以下是一個(gè)簡單的示例：

#include <iostream>
#include <windows.h>

void MonitorDirectory(LPCWSTR path) {
    HANDLE hDir = CreateFileW(path, FILE_LIST_DIRECTORY, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OVERLAPPED, NULL);
    if (hDir == INVALID_HANDLE_VALUE) {
        std::cerr << "Failed to open directory: " << path << std::endl;
        return;
    }

    BYTE buffer[1024];
    DWORD bytesReturned;
    OVERLAPPED overlapped = { 0 };
    overlapped.hEvent = CreateEvent(NULL, TRUE, FALSE, NULL);

    while (true) {
        if (ReadDirectoryChangesW(hDir, buffer, sizeof(buffer), TRUE, FILE_NOTIFY_CHANGE_FILE_NAME | FILE_NOTIFY_CHANGE_DIR_NAME | FILE_NOTIFY_CHANGE_ATTRIBUTES | FILE_NOTIFY_CHANGE_SIZE | FILE_NOTIFY_CHANGE_LAST_WRITE | FILE_NOTIFY_CHANGE_CREATION, &bytesReturned, &overlapped)) {
            DWORD bytesTransferred;
            if (GetOverlappedResult(hDir, &overlapped, &bytesTransferred, TRUE)) {
                FILE_NOTIFY_INFORMATION *pNotifyInfo = (FILE_NOTIFY_INFORMATION *)buffer;
                do {
                    std::wstring fileName(pNotifyInfo->FileName, pNotifyInfo->FileNameLength / sizeof(wchar_t));
                    if (fileName == L"." || fileName == L"..") {
                        continue;
                    }

                    if (pNotifyInfo->Action == FILE_ACTION_ADDED || pNotifyInfo->Action == FILE_ACTION_MODIFIED || pNotifyInfo->Action == FILE_ACTION_RENAMED_OLD_NAME) {
                        std::cout << "File system change detected: " << fileName << std::endl;
                    }

                    pNotifyInfo = (FILE_NOTIFY_INFORMATION *)((BYTE *)pNotifyInfo + pNotifyInfo->NextEntryOffset);
                } while (pNotifyInfo->NextEntryOffset != 0);
            }
        }
    }

    CloseHandle(hDir);
    CloseHandle(overlapped.hEvent);
}

int main() {
    std::wstring path = L"C:\\your\\directory";
    MonitorDirectory(path.c_str());
    return 0;
}

這個(gè)示例使用CreateFileW函數(shù)打開一個(gè)目錄，并使用ReadDirectoryChangesW函數(shù)監(jiān)控該目錄中的文件系統(tǒng)變化。當(dāng)檢測到文件創(chuàng)建、修改或重命名等操作時(shí)，將輸出一條消息。

請(qǐng)注意，這些示例僅用于演示目的，實(shí)際應(yīng)用中可能需要根據(jù)具體需求進(jìn)行調(diào)整。在使用鉤子時(shí)，請(qǐng)確保遵循最佳實(shí)踐，以避免對(duì)系統(tǒng)性能產(chǎn)生負(fù)面影響。