You can use this api http://msdn.microsoft.com/en-us/library/windows/desktop/aa365261(v=vs.85).aspx This api is limited and if your task is out of scope of this api you must go in minifilter driver wonderland.
How to observe made Windows System Changes by a Program
-
16-06-2023 - |
Question
I just came up with a Question thats bugging me. I would like to create or find a Program that can observe filesystem changes and registry etc. Changes made by another Executable. Like Starting a Program through Another and observing the windows api calls or something.
Is that possible? And how would I go about it?
Thanks in advance.
Solution
Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow