windbg脚本实践1----监控特定文件创建 删除 读写

$$*****************************************************************
$$ Script by kms_hhl to monitor file create read write delete and show call stack
$$ Create Time 2014_11
$$ Execute by $$><D:\BaiduYunTongBu\百度云同步盘\windbg_sc\1sc_file_monitor.txt
$$*****************************************************************

bp Ntfs!NtfsFsdSetInformation"
r $t0=poi(poi(poi(esp+8)+64)+34)
as /mu $FileNameA $t0
.block
{
.if ($spat(\" ${$FileNameA} \",\" *virus.dll* \"))
	{
		.echo found the pattern
		.echo $FileNameA
		ad *
	}
.else
	{
		.echo not found the pattern
		.echo ‘ $FileNameA ‘
		ad *
		gc
	}
}"

bp Ntfs!NtfsSetRenameInfo"
r $t1=poi(poi(poi(esp+c)+64)+34)
as /mu $FileNameB $t1
.block
{
.if ($spat(\" ${$FileNameB} \",\" *virus.dll* \"))
	{
		.echo found the pattern
		.echo $FileNameB
		ad *
	}
.else
	{
		.echo not found the pattern
		.echo ‘ $FileNameB ‘
		ad *
		gc
	}
}"


bp Ntfs!NtfsSetDispositionInfo"
r $t2=poi(poi(poi(esp+c)+64)+34)
as /mu $FileNameC $t2
.block
{
.if ($spat(\" ${$FileNameC} \",\" *virus.dll* \"))
	{
		.echo found the pattern
		.echo $FileNameC
		ad *
	}
.else
	{
		.echo not found the pattern
		.echo ‘ $FileNameC ‘
		ad *
		gc
	}
}"