Development of file Filter Driver (I)

Recently, I have read a lot of questions about file system monitoring, which may be divided into two categories.
One is to develop a background program to monitor changes to the entire file system. For example, when an action occurs to generate, modify, move, delete, or copy a file, the monitoring program can obtain the file name, address, and action type. This is relatively simple. You can use findfirstchangenotification. The approximate method is to write a while (1) To return the value of waitformultipleobjects.
The first one is file operation interception. The last one is after the operation is completed. This is because the operation is approved by me before each operation.
Let's talk about the implementation idea first. If you do this, Filemon must know about it. In addition, you are ready to download the Win2000 ifs SDK and win2000 DDK. Of course, driverstudio2.7 also needs it. This article (below) will detail this development for Win9x/winnt/Win2k/WINXP/win2003.

Now write the code 1, and you may have a bug:
The findfirstchangenotification function creates a change notification handle and sets an initial change notification filter condition.
When a change in a specified directory or sub-directory meets the filtering conditions, wait for the notification handle to succeed.
Prototype:
Handle findfirstchangenotification (
Lpctstr lppathname, // directory
Bool bwatchsubtree, // Option
DWORD dwpolicyfilter // filter Condition
);

The waitformultipleobjects function returns
1. One or all specified objects are in the signaled state)
2. Timeout Interval

The Code is as follows:
DWORD dwwaitstatus;
Handle dwchangehandles [2];
 
// Monitor C:/create and delete files in the Windows directory
 
Dwchangehandles [0] = findfirstchangenotification (
"C: // windows", // directory to watch
False, // do not watch the subtree
File_policy_change_file_name); // watch file name changes
 
If (dwchangehandles [0] = invalid_handle_value)
Exitprocess (getlasterror ());
 
// Monitor C:/create and delete sub-directory tree files
 
Dwchangehandles [1] = findfirstchangenotification (
"C: //", // directory to watch
True, // watch the subtree
File_policy_change_dir_name); // watch dir. Name Changes
 
If (dwchangehandles [1] = invalid_handle_value)
Exitprocess (getlasterror ());
 
// Change notification is set. Now wait on both notification
// Handles and refresh accordingly.
 
While (1)
{
 
// Wait for notification.
 
Dwwaitstatus = waitformultipleobjects (2, dwchangehandles, false, infinite );
 
Switch (dwwaitstatus)
{
Case wait_object_0:
 
// Create or delete files in the C:/Windows directory.
// Refresh the Directory and restart change notification ).
 
Afxmessagebox ("Refresh directory ");
If (findnextchangenotification (dwchangehandles [0]) = false)
Exitprocess (getlasterror ());
Break;
 
Case wait_object_0 + 1:
// Create or delete files in the C:/Windows directory.
// Refresh the directory tree and restart the change notification ).
 
Afxmessagebox ("Refresh directory tree ");
If (findnextchangenotification (dwchangehandles [1]) = false)
Exitprocess (getlasterror ());
Break;
 
Default:
Exitprocess (getlasterror ());
}
}