delphi 监控系统文件操作

    你是否想为你的Windows加上一双眼睛，察看使用者在机器上所做的各种操作（例如建立、删除文件；改变文件或目录名字）呢？

    这里介绍一种利用Windows未公开函数实现这个功能的方法。

    在Windows下有一个未公开函数SHChangeNotifyRegister可以把你的窗口添加到系统的系统消息监视链中，该函数在Delphi中的定义如下：

    Function SHChangeNotifyRegister(hWnd,uFlags,dwEventID,uMSG,cItems:LongWord;
    lpps:PIDLSTRUCT):integer;stdcall;external 'Shell32.dll' index 2;

    其中参数hWnd定义了监视系统操作的窗口得句柄，参数uFlags dwEventID定义监视操作参数，参数uMsg定义操作消息，参数cItems定义附加参数，参数lpps指定一个PIDLSTRUCT结构，该结构指定监视的目录。

    当函数调用成功之后，函数会返回一个监视操作句柄，同时系统就会将hWnd指定的窗口加入到操作监视链中，当有文件操作发生时，系统会向hWnd发送uMsg指定的消息，我们只要在程序中加入该消息的处理函数就可以实现对系统操作的监视了。

    如果要退出程序监视，就要调用另外一个未公开得函数SHChangeNotifyDeregister来取消程序监视。

    下面是使用Delphi编写的具体程序实现范例，首先建立一个新的工程文件，然后在Form1中加入一个Button控件和一个Memo控件，

    程序的代码如下：

unit ufrmMain;interfaceuses  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,  Dialogs ,shlobj, Activex, StdCtrls,  Menus,  uTbLogFile;const    SHCNE_RENAMEITEM = $1;  SHCNE_CREATE = $2;  SHCNE_DELETE = $4;    SHCNE_MKDIR = $8;    SHCNE_RMDIR = $10;    SHCNE_MEDIAINSERTED = $20;    SHCNE_MEDIAREMOVED = $40;    SHCNE_DRIVEREMOVED = $80;    SHCNE_DRIVEADD = $100;    SHCNE_NETSHARE = $200;  SHCNE_NETUNSHARE = $400;  SHCNE_ATTRIBUTES = $800;    SHCNE_UPDATEDIR = $1000;  SHCNE_UPDATEITEM = $2000;    SHCNE_SERVERDISCONNECT = $4000;  SHCNE_UPDATEIMAGE = $8000;    SHCNE_DRIVEADDGUI = $10000;    SHCNE_RENAMEFOLDER = $20000;    SHCNE_FREESPACE = $40000;    SHCNE_ASSOCCHANGED = $8000000;    SHCNE_DISKEVENTS = $2381F;  SHCNE_GLOBALEVENTS = $C0581E0;  SHCNE_ALLEVENTS = $7FFFFFFF;  SHCNE_INTERRUPT = $80000000;  SHCNF_IDLIST = 0;    // LPITEMIDLIST    SHCNF_PATHA = $1;    // path name    SHCNF_PRINTERA = $2;    // printer friendly name    SHCNF_DWORD = $3;    // DWORD    SHCNF_PATHW = $5;    // path name    SHCNF_PRINTERW = $6;    // printer friendly name    SHCNF_TYPE = $FF;    SHCNF_FLUSH = $1000;    SHCNF_FLUSHNOWAIT = $2000;  SHCNF_PATH = SHCNF_PATHW;    SHCNF_PRINTER = SHCNF_PRINTERW;    WM_SHNOTIFY = $401;    NOERROR = 0;  type  TForm1 = class(TForm)    mmo1: TMemo;    Button1: TButton;    procedure FormCreate(Sender: TObject);    procedure FormClose(Sender: TObject; var Action: TCloseAction);    procedure btn1Click(Sender: TObject);    procedure FormDestroy(Sender: TObject);  private    WRITE_LOG : TRTLCriticalSection;    FLogWriterSetupForm: TTbLogFile;  public    procedure WMShellReg(var Message:TMessage);message WM_SHNOTIFY;  end;type  PSHNOTIFYSTRUCT=^SHNOTIFYSTRUCT;  SHNOTIFYSTRUCT = record    dwItem1 : PItemIDList;    dwItem2 : PItemIDList;  end;Type  PSHFileInfoByte=^SHFileInfoByte;  _SHFileInfoByte = record    hIcon :Integer;    iIcon :Integer;    dwAttributes : Integer;    szDisplayName : array [0..259] of char;    szTypeName : array [0..79] of char;  end;    SHFileInfoByte=_SHFileInfoByte;  Type PIDLSTRUCT = ^IDLSTRUCT;    _IDLSTRUCT = record    pidl : PItemIDList;    bWatchSubFolders : Integer;  end;  IDLSTRUCT = _IDLSTRUCT;    function SHNotify_Register(hWnd : Integer) : Bool;  function SHNotify_UnRegister:Bool;    function SHEventName(strPath1,strPath2:string;lParam:Integer):string;  Function SHChangeNotifyDeregister(hNotify:integer):integer;stdcall;external 'Shell32.dll' index 4;    Function SHChangeNotifyRegister(hWnd,uFlags,dwEventID,uMSG,cItems:LongWord;lpps:PIDLSTRUCT):integer;stdcall;external 'Shell32.dll' index 2;    Function SHGetFileInfoPidl(pidl : PItemIDList;dwFileAttributes : Integer;psfib : PSHFILEINFOBYTE;cbFileInfo : Integer;uFlags : Integer):Integer;stdcall;external 'Shell32.dll' name 'SHGetFileInfoA';  var  Form1: TForm1;  m_hSHNotify:Integer;  m_pidlDesktop : PItemIDList;implementation{$R *.dfm}function SHEventName(strPath1, strPath2: string; lParam: Integer): string;var    sEvent:String;  begin    case lParam of        //根据参数设置提示消息    SHCNE_RENAMEITEM: sEvent := '重命名文件' + strPath1 + '为' + strpath2;    SHCNE_CREATE: sEvent := '建立文件 文件名：' + strPath1;    SHCNE_DELETE: sEvent := '删除文件 文件名：' + strPath1;    SHCNE_MKDIR: sEvent := '新建目录 目录名：' + strPath1;    SHCNE_RMDIR: sEvent := '删除目录 目录名：' + strPath1;    SHCNE_MEDIAINSERTED: sEvent := strPath1 + '中插入可移动存储介质';    SHCNE_MEDIAREMOVED: sEvent := strPath1 + '中移去可移动存储介质' + strPath1 + ' '+strpath2;    SHCNE_DRIVEREMOVED: sEvent := '移去驱动器' + strPath1;    SHCNE_DRIVEADD: sEvent := '添加驱动器' + strPath1;    SHCNE_NETSHARE: sEvent := '改变目录' + strPath1 + '的共享属性';      SHCNE_ATTRIBUTES: sEvent := '改变文件目录属性 文件名' + strPath1;    SHCNE_UPDATEDIR: sEvent := '更新目录' + strPath1;    SHCNE_UPDATEITEM: sEvent := '更新文件 文件名：' + strPath1;    SHCNE_SERVERDISCONNECT: sEvent := '断开与服务器的连接' + strPath1 + ' ' + strpath2;    SHCNE_UPDATEIMAGE: sEvent := 'SHCNE_UPDATEIMAGE';    SHCNE_DRIVEADDGUI: sEvent := 'SHCNE_DRIVEADDGUI';      SHCNE_RENAMEFOLDER: sEvent := '重命名文件夹' + strPath1 + '为' + strpath2;    SHCNE_FREESPACE: sEvent := '磁盘空间大小改变';    SHCNE_ASSOCCHANGED: sEvent := '改变文件关联';  else      sEvent := '未知操作' + IntToStr(lParam);  end;    Result := sEvent;  end;  function SHNotify_Register(hWnd: Integer): Bool;var    ps: pidlstruct;begin    {$R-}    result := false;    if m_hshnotify = 0 then  begin    //获取桌面文件夹的pidl      if shgetspecialfolderlocation(0, CSIDL_DESKTOP, m_pidldesktop) <> noerror then      form1.close;      if boolean(m_pidldesktop) then begin        new(ps);        try        ps.bwatchsubfolders := 1;        ps.pidl := m_pidldesktop;                    // 利用shchangenotifyregister函数注册系统消息处理          m_hshnotify := shchangenotifyregister(hwnd, (shcnf_type or shcnf_idlist),          (shcne_allevents or shcne_interrupt),          wm_shnotify, 1, ps);          result := boolean(m_hshnotify);        finally        FreeMem(ps);      end;    end    else    begin      // 如果出现错误就使用 cotaskmemfree函数来释放句柄      cotaskmemfree(m_pidldesktop);    end;     end;    {$R+}  end;  function SHNotify_UnRegister: Bool;begin    Result := False;  If Boolean(m_hSHNotify) Then  begin    //取消系统消息监视，同时释放桌面的Pidl      If Boolean(SHChangeNotifyDeregister(m_hSHNotify)) Then begin      {$R-}      m_hSHNotify := 0;      CoTaskMemFree(m_pidlDesktop);      Result := True;      {$R-}    End;  end;end;procedure TForm1.WMShellReg(var Message: TMessage);  //file://系统消息处理函数  var    strPath1,strPath2:String;    charPath:array[0..259]of char;    pidlItem:PSHNOTIFYSTRUCT;  begin    pidlItem := PSHNOTIFYSTRUCT(Message.wParam);  //file://获得系统消息相关得路径  SHGetPathFromIDList(pidlItem.dwItem1, charPath);  strPath1 := charPath;  SHGetPathFromIDList(pidlItem.dwItem2, charPath);  strPath2 := charPath;   try    EnterCriticalSection(WRITE_LOG);    FLogWriterSetupForm.WriteLnLog(SHEvEntName(strPath1, strPath2, Message.lParam) + chr(13) + chr(10));  finally    LeaveCriticalSection(WRITE_LOG);  end;//  mmo1.Lines.Add(SHEvEntName(strPath1,strPath2,Message.lParam)+chr(13)+chr(10));end;{获得计算机名}function GetComputerName: string;var  buffer: array[0..MAX_COMPUTERNAME_LENGTH + 1] of Char;  Size: Cardinal;begin  Size := MAX_COMPUTERNAME_LENGTH + 1;  Windows.GetComputerName(@buffer, Size);  Result := strpas(buffer);end;procedure TForm1.FormCreate(Sender: TObject);begin  Caption := GetComputerName;  InitializeCriticalSection(WRITE_LOG);  FLogWriterSetupForm := TTbLogFile.Create(nil);  FLogWriterSetupForm.AutoRenameByDay := True;  FLogWriterSetupForm.Open(ExtractFilePath(ParamStr(0)) + ' 操作.log', otAppend);end;procedure TForm1.FormClose(Sender: TObject; var Action: TCloseAction);begin  //在程序退出的同时删除监视    if Boolean(m_pidlDesktop) then      SHNotify_Unregister;end;procedure TForm1.btn1Click(Sender: TObject);begin  m_hSHNotify:=0;    if SHNotify_Register(Form1.Handle) then begin //file://注册Shell监视      ShowMessage('Shell监视程序成功注册');      Button1.Enabled := False;  end    else    ShowMessage('Shell监视程序注册失败');end;procedure TForm1.FormDestroy(Sender: TObject);begin  DeleteCriticalSection(WRITE_LOG);  FreeAndNil(FLogWriterSetupForm);end;end.

    运行程序，点击“打开监视”按钮，如果出现一个显示“Shell监视程序成功注册”的对话框，说明Form1已经加入到系统操作监视链中了，你可以试着在资源管理器中建立、删除文件夹，移动文件等操作，你可以发现这些操作都被记录下来并显示在文本框中。

    在上面的程序中多次使用到了一个PItemIDList的结构，这个数据结构指定Windows下得一个“项目”，在Windows下资源实现统一管理一个“项目”可以是一个文件或者一个文件夹，也可以是一个打印机等资源。另外一些API函数也涉及到了Shell(Windows外壳)操作，各位读者可以参考相应的参考资料。

    以上程序在Windows98、Windows2000、Delphi5下运行通过。