public SearchResult(Win32.UsnEntry usnEntry, UsnJournal journal) { UsnEntry = usnEntry; _journal = journal; _driveName = journal.RootDirectory.FullName; }
public DeviceDetectorEventArgs(Win32.DBT changeType, Win32.DBCH_DEVICETYPE? deviceType, object deviceInfo) { Cancel = false; _ChangeType = changeType; _DeviceInfo = deviceInfo; _DeviceType = deviceType; }
public DataBase( Win32.USER32.TBBUTTON tbButton, string buttonText, IntPtr windowHandle, int imageIndex ) { _TBButton = tbButton; _ButtonText = buttonText; _WindowHandle = windowHandle; _ImageIndex = imageIndex; }
public void AddBubbleEvent(Func<BubbleEventArgs, bool> handleEvent, Win32.WM message) { messages.Add((int)message, new BubbleEvent { Message = message, HandleEvent = handleEvent }); }
private int WndProcHook(int nCode, IntPtr wParam, ref Win32.Message lParam) { if (nCode >= 0) { Win32.TranslateMessage(ref lParam); // You may want to remove this line, if you find your not quite getting the right messages through. This is here so that WM_CHAR is correctly called when a key is pressed. WndProc(ref lParam); } return Win32.CallNextHookEx(hHook, nCode, wParam, ref lParam); }
public DeviceInfo(string deviceId, string manufacturer, string description, Guid classGuid, string classDescription, Win32.DeviceNodeStatus status, uint vid, uint pid, uint rev) { _DeviceId = deviceId ?? ""; _Description = description ?? ""; _Manufacturer = manufacturer ?? ""; _ClassGuid = classGuid; _ClassDescription = classDescription ?? ""; _Status = status; _VendorId = vid; _ProductId = pid; _Revision = rev; }
static void HasTitleBarButtonChangedCallback(DependencyObject obj, DependencyPropertyChangedEventArgs e, Win32.WindowStyles button) { var window = obj as Window; if (window == null) return; if (!window.IsLoaded) window.Loaded += s_loadedHandler; else InternalSetStyleFlag(window, button, (bool)e.NewValue); }
public DebugProcess(Debuggee dbg, Win32.CREATE_PROCESS_DEBUG_INFO info, uint id, uint threadId) { this.Debuggee = dbg; Handle = info.hProcess; Id = id == 0 ? API.GetProcessId(Handle) : id; var moduleFile = APIIntermediate.GetModulePath(Handle, info.lpBaseOfImage, info.hFile); // Deduce main module MainModule = new DebugProcessModule(info.lpBaseOfImage, moduleFile, ExecutableMetaInfo.ExtractFrom(moduleFile)); RegModule(MainModule); // Create main thread MainThread = new DebugThread(this, info.hThread, threadId == 0 ? API.GetThreadId(info.hThread) : threadId, info.lpStartAddress, info.lpThreadLocalBase); RegThread(MainThread); }
public static extern IntPtr SetWindowsHookEx(Win32.HookType code, HookProc func, IntPtr hInstance, int threadID);
static bool GetDeviceNodeStatus(UInt32 dnDevInst, IntPtr hMachine, out Win32.DeviceNodeStatus status) { // c:\Program Files\Microsoft SDKs\Windows\v7.1\Include\cfg.h uint Status; uint ProblemNumber; bool success = false; // http://msdn.microsoft.com/en-gb/library/windows/hardware/ff538517%28v=vs.85%29.aspx var cr = CM_Get_DevNode_Status_Ex(out Status, out ProblemNumber, dnDevInst, 0, hMachine); status = 0; if (cr == CR.CR_SUCCESS) { status = (Win32.DeviceNodeStatus)Status; success = true; } return success; }
public static extern int GetClipBox(IntPtr hDC, ref Win32.RECT rectBox);
/// <summary> /// Helper function to set or clear a bit in the flags field. /// </summary> /// <param name="flag">The Flag bit to set or clear.</param> /// <param name="value">True to set, false to clear the bit in the flags field.</param> private void SetFlag( Win32.NativeMethods.TASKDIALOG_FLAGS flag, bool value ) { if ( value ) { this.flags |= flag; } else { this.flags &= ~flag; } }
public void DirectionResize(Win32.ResizeDirection direction) { int _direction = -1; switch (direction) { case Win32.ResizeDirection.Left: _direction = Win32.HTLEFT; break; case Win32.ResizeDirection.TopLeft: _direction = Win32.HTTOPLEFT; break; case Win32.ResizeDirection.Top: _direction = Win32.HTTOP; break; case Win32.ResizeDirection.TopRight: _direction = Win32.HTTOPRIGHT; break; case Win32.ResizeDirection.Right: _direction = Win32.HTRIGHT; break; case Win32.ResizeDirection.BottomRight: _direction = Win32.HTBOTTOMRIGHT; break; case Win32.ResizeDirection.Bottom: _direction = Win32.HTBOTTOM; break; case Win32.ResizeDirection.BottomLeft: _direction = Win32.HTBOTTOMLEFT; break; } if (_direction != -1) { Win32.ReleaseCapture(); Win32.SendMessage(this.Handle, Win32.WM_NCLBUTTONDOWN, _direction, 0); } }
internal void OnWM_MOUSEMOVE(Win32.POINT screenPos) { // Convert the mouse position to screen coordinates User32.ScreenToClient(this.Handle, ref screenPos); OnProcessMouseMove(screenPos.x, screenPos.y); }
void hsServer_ClientStyleChanged(Win32.WindowShowStyle style) { MethodInvoker action = delegate { gbClient.Enabled = true; if (style == Win32.WindowShowStyle.Hide) cbShowHideClient.Checked = false; else if (style == Win32.WindowShowStyle.Show) cbShowHideClient.Checked = true; }; this.Invoke(action); }
/// <summary> /// GetUsnJournalState() gets the current state of the USN Journal if it is active. /// </summary> /// <param name="usnJournalState"> /// Reference to usn journal data object filled with the current USN Journal state. /// </param> /// <returns> /// USN_JOURNAL_SUCCESS GetUsnJournalState() function succeeded. /// VOLUME_NOT_NTFS volume is not an NTFS volume. /// INVALID_HANDLE_VALUE NtfsUsnJournal object failed initialization. /// USN_JOURNAL_NOT_ACTIVE usn journal is not active on volume. /// ERROR_ACCESS_DENIED accessing the usn journal requires admin rights, see remarks. /// ERROR_INVALID_FUNCTION error generated by DeviceIoControl() call. /// ERROR_FILE_NOT_FOUND error generated by DeviceIoControl() call. /// ERROR_PATH_NOT_FOUND error generated by DeviceIoControl() call. /// ERROR_TOO_MANY_OPEN_FILES error generated by DeviceIoControl() call. /// ERROR_INVALID_HANDLE error generated by DeviceIoControl() call. /// ERROR_INVALID_DATA error generated by DeviceIoControl() call. /// ERROR_NOT_SUPPORTED error generated by DeviceIoControl() call. /// ERROR_INVALID_PARAMETER error generated by DeviceIoControl() call. /// ERROR_JOURNAL_DELETE_IN_PROGRESS usn journal delete is in progress. /// ERROR_INVALID_USER_BUFFER error generated by DeviceIoControl() call. /// USN_JOURNAL_ERROR unspecified usn journal error. /// </returns> /// <remarks> /// If function returns ERROR_ACCESS_DENIED you need to run application as an Administrator. /// </remarks> public UsnJournalReturnCode GetUsnJournalState(ref Win32.USN_JOURNAL_DATA usnJournalState) { UsnJournalReturnCode returnCode = UsnJournalReturnCode.VOLUME_NOT_NTFS; if (IsNtfsVolume) { if (_usnJournalRootHandle.ToInt32() != Win32.INVALID_HANDLE_VALUE) { returnCode = QueryUsnJournal(ref usnJournalState); } else { returnCode = UsnJournalReturnCode.INVALID_HANDLE_VALUE; } } return returnCode; }
/// <summary> /// Rests to see if there is a USN Journal on this volume and if there is /// determines whether any journal entries have been lost. /// </summary> /// <returns>true if the USN Journal is active and if the JournalId's are the same /// and if all the usn journal entries expected by the previous state are available /// from the current state. /// false if not</returns> public bool IsUsnJournalValid(Win32.USN_JOURNAL_DATA usnJournalPreviousState) { bool bRtnCode = false; if (IsNtfsVolume) { if (_usnJournalRootHandle.ToInt32() != Win32.INVALID_HANDLE_VALUE) { var usnJournalState = new Win32.USN_JOURNAL_DATA(); var usnError = QueryUsnJournal(ref usnJournalState); if (usnError == UsnJournalReturnCode.USN_JOURNAL_SUCCESS) { if (usnJournalPreviousState.UsnJournalID == usnJournalState.UsnJournalID) { if (usnJournalPreviousState.NextUsn >= usnJournalState.NextUsn) { bRtnCode = true; } } } } } return bRtnCode; }
protected bool ProcessInterceptedMessage(ref Win32.MSG msg) { bool eat = false; switch(msg.message) { case (int)Win32.Msgs.WM_LBUTTONDOWN: case (int)Win32.Msgs.WM_MBUTTONDOWN: case (int)Win32.Msgs.WM_RBUTTONDOWN: case (int)Win32.Msgs.WM_XBUTTONDOWN: case (int)Win32.Msgs.WM_NCLBUTTONDOWN: case (int)Win32.Msgs.WM_NCMBUTTONDOWN: case (int)Win32.Msgs.WM_NCRBUTTONDOWN: // Mouse clicks cause the end of simulated focus unless they are // inside the client area of the menu control itself Point pt = new Point( (int)((uint)msg.lParam & 0x0000FFFFU), (int)(((uint)msg.lParam & 0xFFFF0000U) >> 16)); if (!this.ClientRectangle.Contains(pt)) SimulateReturnFocus(); break; case (int)Win32.Msgs.WM_KEYDOWN: // Find up/down state of shift and control keys ushort shiftKey = User32.GetKeyState((int)Win32.VirtualKeys.VK_SHIFT); ushort controlKey = User32.GetKeyState((int)Win32.VirtualKeys.VK_CONTROL); // Basic code we are looking for is the key pressed... int basecode = (int)msg.wParam; int code = basecode; // ...plus the modifier for SHIFT... if (((int)shiftKey & 0x00008000) != 0) code += 0x00010000; // ...plus the modifier for CONTROL if (((int)controlKey & 0x00008000) != 0) code += 0x00020000; if (code == (int)Win32.VirtualKeys.VK_ESCAPE) { // Is an item being tracked if (_trackItem != -1) { // Is it also showing a submenu if (_popupMenu == null) { // Unselect the current item _trackItem = SwitchTrackingItem(_trackItem, -1); } } SimulateReturnFocus(); // Prevent intended destination getting message eat = true; } else if (code == (int)Win32.VirtualKeys.VK_LEFT) { if (_direction == Direction.Horizontal) ProcessMoveLeft(false); if (_selected) _ignoreMouseMove = true; // Prevent intended destination getting message eat = true; } else if (code == (int)Win32.VirtualKeys.VK_RIGHT) { if (_direction == Direction.Horizontal) ProcessMoveRight(false); else ProcessMoveDown(); if (_selected) _ignoreMouseMove = true; // Prevent intended destination getting message eat = true; } else if (code == (int)Win32.VirtualKeys.VK_RETURN) { ProcessEnter(); // Prevent intended destination getting message eat = true; } else if (code == (int)Win32.VirtualKeys.VK_DOWN) { if (_direction == Direction.Horizontal) ProcessMoveDown(); else ProcessMoveRight(false); // Prevent intended destination getting message eat = true; } else if (code == (int)Win32.VirtualKeys.VK_UP) { ProcessMoveLeft(false); // Prevent intended destination getting message eat = true; } else { // Construct shortcut from keystate and keychar Shortcut sc = (Shortcut)(code); // Search for a matching command if (!GenerateShortcut(sc, _menuCommands)) { // Last resort is treat as a potential mnemonic ProcessMnemonicKey((char)msg.wParam); if (_selected) _ignoreMouseMove = true; } else { SimulateReturnFocus(); } // Always eat keyboard message in simulated focus eat = true; } break; case (int)Win32.Msgs.WM_KEYUP: eat = true; break; case (int)Win32.Msgs.WM_SYSKEYUP: // Ignore keyboard input if the control is disabled if ((int)msg.wParam == (int)Win32.VirtualKeys.VK_MENU) { if (_trackItem != -1) { // Is it also showing a submenu if (_popupMenu == null) { // Unselect the current item _trackItem = SwitchTrackingItem(_trackItem, -1); } } SimulateReturnFocus(); // Always eat keyboard message in simulated focus eat = true; } break; case (int)Win32.Msgs.WM_SYSKEYDOWN: if ((int)msg.wParam != (int)Win32.VirtualKeys.VK_MENU) { // Construct shortcut from ALT + keychar Shortcut sc = (Shortcut)(0x00040000 + (int)msg.wParam); // Search for a matching command if (!GenerateShortcut(sc, _menuCommands)) { // Last resort is treat as a potential mnemonic ProcessMnemonicKey((char)msg.wParam); if (_selected) _ignoreMouseMove = true; } else { SimulateReturnFocus(); } // Always eat keyboard message in simulated focus eat = true; } break; default: break; } return eat; }
private static void SetWindowFromInfo(IntPtr hwnd, Win32.WINDOWINFO info) { int x1 = info.rcWindow.left; int y1 = info.rcWindow.top; int x2 = info.rcWindow.right - x1; int y2 = info.rcWindow.bottom - y1; //Win32.SetWindowLong(hwnd, Win32.GWL_STYLE, (int)info.dwStyle); //Win32.SetWindowLong(hwnd, Win32.GWL_EXSTYLE, (int)info.dwExStyle); Win32.SetWindowPos(hwnd, Win32.HWND_NOTOPMOST, x1, y1, x2, y2, Win32.SWP_SHOWWINDOW); }
private static string ReadRegistryString(Win32.RegistryKey key, string path, string registryValue) { RegistryKey subKey = key.OpenSubKey(path, false); object oValue = subKey?.GetValue(registryValue); if (oValue != null && subKey.GetValueKind(registryValue) == RegistryValueKind.String) { return (string)oValue; } return null; }
/// <summary> /// Initializing /// </summary> /// <param name="sender"></param> /// <param name="e"></param> /// <summary> /// Display record, sound indicate /// </summary> /// <param name="beepMessage"></param> /// <param name="beepType"></param> private void ShowResult(string beepMessage, Win32.BeepType beepType) { lstResult.Items.Add(beepMessage); lstResult.SelectedIndex = lstResult.Items.Count - 1; }
/// <summary> /// Converts a Win32 Error to a UsnJournalReturnCode /// </summary> /// <param name="Win32LastError">The 'last' Win32 error.</param> /// <returns> /// INVALID_HANDLE_VALUE error generated by Win32 Api calls. /// USN_JOURNAL_SUCCESS usn journal function succeeded. /// ERROR_INVALID_FUNCTION error generated by Win32 Api calls. /// ERROR_FILE_NOT_FOUND error generated by Win32 Api calls. /// ERROR_PATH_NOT_FOUND error generated by Win32 Api calls. /// ERROR_TOO_MANY_OPEN_FILES error generated by Win32 Api calls. /// ERROR_ACCESS_DENIED accessing the usn journal requires admin rights. /// ERROR_INVALID_HANDLE error generated by Win32 Api calls. /// ERROR_INVALID_DATA error generated by Win32 Api calls. /// ERROR_HANDLE_EOF error generated by Win32 Api calls. /// ERROR_NOT_SUPPORTED error generated by Win32 Api calls. /// ERROR_INVALID_PARAMETER error generated by Win32 Api calls. /// ERROR_JOURNAL_DELETE_IN_PROGRESS usn journal delete is in progress. /// ERROR_JOURNAL_ENTRY_DELETED usn journal entry lost, no longer available. /// ERROR_INVALID_USER_BUFFER error generated by Win32 Api calls. /// USN_JOURNAL_INVALID usn journal is invalid, id's don't match or required entries lost. /// USN_JOURNAL_NOT_ACTIVE usn journal is not active on volume. /// VOLUME_NOT_NTFS volume is not an NTFS volume. /// INVALID_FILE_REFERENCE_NUMBER bad file reference number - see remarks. /// USN_JOURNAL_ERROR unspecified usn journal error. /// </returns> private UsnJournalReturnCode ConvertWin32ErrorToUsnError(Win32.GetLastErrorEnum Win32LastError) { UsnJournalReturnCode returnCode; switch (Win32LastError) { case Win32.GetLastErrorEnum.ERROR_JOURNAL_NOT_ACTIVE: returnCode = UsnJournalReturnCode.USN_JOURNAL_NOT_ACTIVE; break; case Win32.GetLastErrorEnum.ERROR_SUCCESS: returnCode = UsnJournalReturnCode.USN_JOURNAL_SUCCESS; break; case Win32.GetLastErrorEnum.ERROR_HANDLE_EOF: returnCode = UsnJournalReturnCode.ERROR_HANDLE_EOF; break; default: returnCode = UsnJournalReturnCode.USN_JOURNAL_ERROR; break; } return returnCode; }
public static extern IntPtr CreateRectRgnIndirect(ref Win32.RECT rect);
/// <summary> /// This function queries the usn journal on the volume. /// </summary> /// <param name="usnJournalState">the USN_JOURNAL_DATA object that is associated with this volume</param> /// <returns></returns> private UsnJournalReturnCode QueryUsnJournal(ref Win32.USN_JOURNAL_DATA usnJournalState) { // Private functions don't need to check for an NTFS volume or // a valid _usnJournalRootHandle handle UsnJournalReturnCode usnReturnCode = UsnJournalReturnCode.USN_JOURNAL_SUCCESS; int sizeUsnJournalState = Marshal.SizeOf(usnJournalState); UInt32 cb; bool fOk = Win32.DeviceIoControl( _usnJournalRootHandle, Win32.FSCTL_QUERY_USN_JOURNAL, IntPtr.Zero, 0, out usnJournalState, sizeUsnJournalState, out cb, IntPtr.Zero); if (!fOk) { //int lastWin32Error = Marshal.GetLastWin32Error(); usnReturnCode = ConvertWin32ErrorToUsnError((Win32.GetLastErrorEnum)Marshal.GetLastWin32Error()); } return usnReturnCode; }
/// <summary> /// Called on each frame update. /// </summary> private int FrameCallbackProc(IntPtr hWnd, ref Win32.VideoHeader VideoHeader) { // Failsafe if(!localGrab) return 1; // Failsafe .. return False if bad if(VideoHeader.lpData == IntPtr.Zero) return 0; // Get image size and dimensions int size = Win32.SendMessage(camWindowHandle, Win32.WM_CAP_GET_VIDEOFORMAT, 0, 0); IntPtr lpVideoFormat = Marshal.AllocHGlobal(size); Win32.SendMessage(camWindowHandle, Win32.WM_CAP_GET_VIDEOFORMAT, size, lpVideoFormat); int cx = Marshal.ReadInt32(lpVideoFormat, 4); int cy = Marshal.ReadInt32(lpVideoFormat, 8); int cbw = cx * 3; int area = (cbw * Math.Abs(cy)); Marshal.FreeHGlobal(lpVideoFormat); lpVideoFormat = IntPtr.Zero; // Create normal bitmap Image img = null; try { img = new Bitmap(cx, Math.Abs(cy), (((VideoHeader.dwBytesUsed > 0) ? (VideoHeader.dwBytesUsed - area) : (0)) + cbw), PixelFormat.Format24bppRgb, VideoHeader.lpData); if(cy > 0) img.RotateFlip(RotateFlipType.RotateNoneFlipY); } catch(NullReferenceException) { return 0; } // Set image frameImage = img; return 1; // True }
/// <summary> /// DeleteUsnJournal() deletes a usn journal on the volume. If no usn journal exists, this /// function simply returns success. /// </summary> /// <param name="journalState">USN_JOURNAL_DATA object for this volume</param> /// <returns>a UsnJournalReturnCode /// USN_JOURNAL_SUCCESS DeleteUsnJournal() function succeeded. /// VOLUME_NOT_NTFS volume is not an NTFS volume. /// INVALID_HANDLE_VALUE NtfsUsnJournal object failed initialization. /// USN_JOURNAL_NOT_ACTIVE usn journal is not active on volume. /// ERROR_ACCESS_DENIED accessing the usn journal requires admin rights, see remarks. /// ERROR_INVALID_FUNCTION error generated by DeviceIoControl() call. /// ERROR_FILE_NOT_FOUND error generated by DeviceIoControl() call. /// ERROR_PATH_NOT_FOUND error generated by DeviceIoControl() call. /// ERROR_TOO_MANY_OPEN_FILES error generated by DeviceIoControl() call. /// ERROR_INVALID_HANDLE error generated by DeviceIoControl() call. /// ERROR_INVALID_DATA error generated by DeviceIoControl() call. /// ERROR_NOT_SUPPORTED error generated by DeviceIoControl() call. /// ERROR_INVALID_PARAMETER error generated by DeviceIoControl() call. /// ERROR_JOURNAL_DELETE_IN_PROGRESS usn journal delete is in progress. /// ERROR_INVALID_USER_BUFFER error generated by DeviceIoControl() call. /// USN_JOURNAL_ERROR unspecified usn journal error. /// </returns> /// <remarks> /// If function returns ERROR_ACCESS_DENIED you need to run application as an Administrator. /// </remarks> public UsnJournalReturnCode DeleteUsnJournal(Win32.USN_JOURNAL_DATA journalState) { var returnCode = UsnJournalReturnCode.VOLUME_NOT_NTFS; if (IsNtfsVolume) { if (_usnJournalRootHandle.ToInt32() != Win32.INVALID_HANDLE_VALUE) { returnCode = UsnJournalReturnCode.USN_JOURNAL_SUCCESS; UInt32 cb; var dujd = new Win32.DELETE_USN_JOURNAL_DATA { UsnJournalID = journalState.UsnJournalID, DeleteFlags = (UInt32)Win32.UsnJournalDeleteFlags.USN_DELETE_FLAG_DELETE }; int sizeDujd = Marshal.SizeOf(dujd); IntPtr dujdBuffer = Marshal.AllocHGlobal(sizeDujd); Win32.ZeroMemory(dujdBuffer, sizeDujd); Marshal.StructureToPtr(dujd, dujdBuffer, true); bool fOk = Win32.DeviceIoControl( _usnJournalRootHandle, Win32.FSCTL_DELETE_USN_JOURNAL, dujdBuffer, sizeDujd, IntPtr.Zero, 0, out cb, IntPtr.Zero); if (!fOk) { returnCode = ConvertWin32ErrorToUsnError((Win32.GetLastErrorEnum)Marshal.GetLastWin32Error()); } Marshal.FreeHGlobal(dujdBuffer); } else { returnCode = UsnJournalReturnCode.INVALID_HANDLE_VALUE; } } return returnCode; }
private int FontProc(ref Win32.ENUMLOGFONTEX lpelfe, ref Win32.NEWTEXTMETRICEX lpntme, uint FontType, IntPtr lParam) { //(lpelfe.lfPitchAndFamily & 2)==0) bool interesting = FontType == 4 && (lpntme.ntmTm.tmPitchAndFamily & 1) == 0 && lpelfe.lfFaceName[0] != '@'; //Terminalは依然ダメ //if(!interesting) // if(lpelfe.lfFaceName=="FixedSys" || lpelfe.lfFaceName=="Terminal") interesting = true; //この2つだけはTrueTypeでなくともリストにいれる if (interesting) { //縦書きでないことはこれでしか判定できないのか? //さぼり if (/*_language==Language.Japanese && */lpntme.ntmTm.tmCharSet == 128/*SHIFTJIS_CHARSET*/ || lpntme.ntmTm.tmCharSet == 129/*HANGUL_CHARSET*/ || lpntme.ntmTm.tmCharSet == 130/*JOHAB_CHARSET*/ || lpntme.ntmTm.tmCharSet == 134/*GB2312_CHARSET*/ || lpntme.ntmTm.tmCharSet == 136/*CHINESEBIG5_CHARSET*/) { _cjkFontList.Items.Add(lpelfe.lfFaceName); //日本語フォントでもASCIIは必ず表示できるはず if (_asciiFontList.FindStringExact(lpelfe.lfFaceName) == -1) _asciiFontList.Items.Add(lpelfe.lfFaceName); } else if (lpntme.ntmTm.tmCharSet == 0) { if (_asciiFontList.FindStringExact(lpelfe.lfFaceName) == -1) _asciiFontList.Items.Add(lpelfe.lfFaceName); } } return 1; }
public int GetFileInformation(string path, out Win32.BY_HANDLE_FILE_INFORMATION? fileInformation) { IntPtr hRoot = Win32.CreateFile(path, 0, Win32.FILE_SHARE_READ | Win32.FILE_SHARE_WRITE, IntPtr.Zero, Win32.OPEN_EXISTING, Win32.FILE_FLAG_BACKUP_SEMANTICS, IntPtr.Zero); if (hRoot.ToInt32() != Win32.INVALID_HANDLE_VALUE) { Win32.BY_HANDLE_FILE_INFORMATION fileInformationTemp; bool success = Win32.GetFileInformationByHandle(hRoot, out fileInformationTemp); if (success) { Win32.CloseHandle(hRoot); fileInformation = fileInformationTemp; return 0; } } fileInformation = new Win32.BY_HANDLE_FILE_INFORMATION(); return Marshal.GetLastWin32Error(); }
public LocalWindowsHook(Win32.HookType hook) { m_hookType = hook; m_filterFunc = new NativeMethods.HookProc(this.CoreHookProc); }
/// <summary> /// Given a previous state, GetUsnJournalEntries() determines if the USN Journal is active and /// no USN Journal entries have been lost (i.e. USN Journal is valid), then /// it loads a SortedList<UInt64, Win32.UsnEntry> list and returns it as the out parameter 'usnEntries'. /// If GetUsnJournalChanges returns anything but USN_JOURNAL_SUCCESS, the usnEntries list will /// be empty. /// </summary> /// <param name="previousUsnState">The USN Journal state the last time volume /// changes were requested.</param> /// <param name="reasonMask"></param> /// <param name="usnEntries"></param> /// <param name="newUsnState"></param> /// <returns> /// USN_JOURNAL_SUCCESS GetUsnJournalChanges() function succeeded. /// VOLUME_NOT_NTFS volume is not an NTFS volume. /// INVALID_HANDLE_VALUE NtfsUsnJournal object failed initialization. /// USN_JOURNAL_NOT_ACTIVE usn journal is not active on volume. /// ERROR_ACCESS_DENIED accessing the usn journal requires admin rights, see remarks. /// ERROR_INVALID_FUNCTION error generated by DeviceIoControl() call. /// ERROR_FILE_NOT_FOUND error generated by DeviceIoControl() call. /// ERROR_PATH_NOT_FOUND error generated by DeviceIoControl() call. /// ERROR_TOO_MANY_OPEN_FILES error generated by DeviceIoControl() call. /// ERROR_INVALID_HANDLE error generated by DeviceIoControl() call. /// ERROR_INVALID_DATA error generated by DeviceIoControl() call. /// ERROR_NOT_SUPPORTED error generated by DeviceIoControl() call. /// ERROR_INVALID_PARAMETER error generated by DeviceIoControl() call. /// ERROR_JOURNAL_DELETE_IN_PROGRESS usn journal delete is in progress. /// ERROR_INVALID_USER_BUFFER error generated by DeviceIoControl() call. /// USN_JOURNAL_ERROR unspecified usn journal error. /// </returns> /// <remarks> /// If function returns ERROR_ACCESS_DENIED you need to run application as an Administrator. /// </remarks> public UsnJournalReturnCode GetUsnJournalEntries(Win32.USN_JOURNAL_DATA previousUsnState, UInt32 reasonMask, out List<Win32.UsnEntry> usnEntries, out Win32.USN_JOURNAL_DATA newUsnState) { usnEntries = new List<Win32.UsnEntry>(); newUsnState = new Win32.USN_JOURNAL_DATA(); UsnJournalReturnCode returnCode = UsnJournalReturnCode.VOLUME_NOT_NTFS; if (IsNtfsVolume) { if (_usnJournalRootHandle.ToInt32() != Win32.INVALID_HANDLE_VALUE) { // get current usn journal state returnCode = QueryUsnJournal(ref newUsnState); if (returnCode == UsnJournalReturnCode.USN_JOURNAL_SUCCESS) { bool bReadMore = true; // sequentially process the usn journal looking for image file entries int pbDataSize = sizeof(UInt64) * 0x4000; IntPtr pbData = Marshal.AllocHGlobal(pbDataSize); Win32.ZeroMemory(pbData, pbDataSize); Win32.READ_USN_JOURNAL_DATA rujd = new Win32.READ_USN_JOURNAL_DATA(); rujd.StartUsn = previousUsnState.NextUsn; rujd.ReasonMask = reasonMask; rujd.ReturnOnlyOnClose = 0; rujd.Timeout = 0; rujd.bytesToWaitFor = 0; rujd.UsnJournalId = previousUsnState.UsnJournalID; int sizeRujd = Marshal.SizeOf(rujd); IntPtr rujdBuffer = Marshal.AllocHGlobal(sizeRujd); Win32.ZeroMemory(rujdBuffer, sizeRujd); Marshal.StructureToPtr(rujd, rujdBuffer, true); // // read usn journal entries // while (bReadMore) { uint outBytesReturned; bool bRtn = Win32.DeviceIoControl( _usnJournalRootHandle, Win32.FSCTL_READ_USN_JOURNAL, rujdBuffer, sizeRujd, pbData, pbDataSize, out outBytesReturned, IntPtr.Zero); if (bRtn) { var pUsnRecord = new IntPtr(pbData.ToInt32() + sizeof(UInt64)); while (outBytesReturned > 60) // while there are at least one entry in the usn journal { var usnEntry = new Win32.UsnEntry(pUsnRecord); if (usnEntry.USN >= newUsnState.NextUsn) // only read until the current usn points beyond the current state's usn { bReadMore = false; break; } usnEntries.Add(usnEntry); pUsnRecord = new IntPtr(pUsnRecord.ToInt32() + usnEntry.RecordLength); outBytesReturned -= usnEntry.RecordLength; } } else { var lastWin32Error = (Win32.GetLastErrorEnum)Marshal.GetLastWin32Error(); if (lastWin32Error == Win32.GetLastErrorEnum.ERROR_HANDLE_EOF) { returnCode = UsnJournalReturnCode.USN_JOURNAL_SUCCESS; } else { returnCode = ConvertWin32ErrorToUsnError(lastWin32Error); } break; } Int64 nextUsn = Marshal.ReadInt64(pbData, 0); if (nextUsn >= newUsnState.NextUsn) { break; } Marshal.WriteInt64(rujdBuffer, nextUsn); } Marshal.FreeHGlobal(rujdBuffer); Marshal.FreeHGlobal(pbData); } } else { returnCode = UsnJournalReturnCode.INVALID_HANDLE_VALUE; } } return returnCode; }