/* Written by Fnems 2010-Oct-23 edited on 2010-Oct-24 This file deals with the algorithem fnems@tom.com for your reference */ #include #include #include #include #define OR || #define AND && #define PRE_TOLERANCE 15 #define LOG_TOLERANCE (61) #define BEEP_WHEN_LOG 0 typedef DWORD (WINAPI *GetModuleFileNameExATP)(HANDLE hProcess, HMODULE hModule, LPTSTR lpFilename, DWORD nSize); typedef DWORD (WINAPI *GetProcessImageFileNameATP)(HANDLE hProcess, LPTSTR lpImageFileName, DWORD nSize); GetModuleFileNameExATP GetModuleFileNameExAP; GetProcessImageFileNameATP GetProcessImageFileNameAP; SYSTEMTIME log_time_struct; DWORD log_pid; DWORD log_tick; HWND log_hwnd; char log_appname[64]; char log_title[128]; char log_date[12]; char log_time[12]; int log_dura; DWORD log_flag; DWORD pre_flag; SYSTEMTIME pre_time_struct; char pre_appname[64]; DWORD pre_flag; DWORD pre_tick; DWORD pre_pid; char pre_title[128]; HWND pre_hwnd; DWORD cur_pid; char cur_title[128]; HMODULE hmod_psapi; int trace_init() { memset(log_appname, 0, 64); memset(log_title, 0, 128); memset(log_date, 0, 12); memset(log_time, 0, 12); log_pid = 0; pre_flag = 0; log_flag = 0; hmod_psapi = LoadLibraryA("psapi.dll"); GetModuleFileNameExAP = (GetModuleFileNameExATP)GetProcAddress(hmod_psapi, "GetModuleFileNameExA"); GetProcessImageFileNameAP = (GetProcessImageFileNameATP)GetProcAddress(hmod_psapi, "GetProcessImageFileNameA"); return 0; } int trace_getnamebypath(LPTSTR path, LPTSTR name) { int i; i=strlen(path)-1; while(i>=0 && path[i]!='\\') i--; strcpy(name, path+i+1); return 0; } int trace_fix_title(LPTSTR title) { size_t i; for(i=0; i= 1) { sprintf(log_date, "%4d%02d%02d", log_time_struct.wYear, log_time_struct.wMonth, log_time_struct.wDay); sprintf(log_time, "%02d%02d%02d", log_time_struct.wHour, log_time_struct.wMinute, log_time_struct.wSecond); trace_log_data(log_appname, log_title, log_date, log_time, log_dura); Beep(440,100); } } cur_tick = GetTickCount(); log_pid = cur_pid; trace_getpidname(log_pid, log_appname, 63); strcpy(log_title, cur_title); GetLocalTime(&log_time_struct); } */ /* new logic table: logflag=1 1 0 ? 1 1 0 1 preflag=1 0 0 1 1 1 1 1 curt=pret ? ? 0 0 1 1 ? cond1 curt=logt 0 ? 0 1 0 0 0 cond2 pretick>t ? ? ? 0 1 1 1 cond3 logtick>t ? ? ? ? 0 - 1 cond4 -- -- -- -- -- -- action 1 2 3 4 5 action1 start pre action2 update pre action3 drop pre, clear pre action4 save pre as new log, clear pre action5 save log */ cond1 = (strcmp(cur_title, pre_title)==0 AND cur_pid==pre_pid); cond2 = (strcmp(cur_title, log_title)==0 AND cur_pid==log_pid); cond3 = (GetTickCount() - pre_tick >= PRE_TOLERANCE*1000); cond4 = (GetTickCount() - log_tick >= LOG_TOLERANCE*1000); if(pre_flag) { /* pre_log has been actived */ if(!cond1 AND cond2 AND !cond3 AND log_flag) { /* action 3 */ pre_flag = 0; } if(!cond1 AND !cond2) { /* action 2 */ pre_pid = cur_pid; strcpy(pre_title, cur_title); GetLocalTime(&pre_time_struct); trace_get_proc_name2(cur_pid, pre_appname, 63); } if(!cond2 AND cond3 AND cond4 AND log_flag) { /* action 5 */ log_dura = (GetTickCount() - log_tick)/60000; sprintf(log_date, "%4d%02d%02d", log_time_struct.wYear, log_time_struct.wMonth, log_time_struct.wDay); sprintf(log_time, "%02d%02d%02d", log_time_struct.wHour, log_time_struct.wMinute, log_time_struct.wSecond); trace_log_data(log_appname, log_title, log_date, log_time, log_dura); log_flag = 0; } if(cond1 AND !cond2 AND cond3 AND !cond4 AND log_flag OR !log_flag AND cond1 AND !cond2 AND cond3) { /* action 4 */ memcpy(&log_time_struct, &pre_time_struct, sizeof(SYSTEMTIME)); strcpy(log_appname, pre_appname); strcpy(log_title, pre_title); log_pid = pre_pid; log_tick = pre_tick; pre_flag = 0; log_flag = 1; } } else { /* else, pre_flag == 0: */ if(!cond2 OR !log_flag) { /* action 1 */ pre_flag = 1; pre_pid = cur_pid; strcpy(pre_title, cur_title); GetLocalTime(&pre_time_struct); trace_get_proc_name2(cur_pid, pre_appname, 63); pre_tick = GetTickCount(); } } /* end if pre_flag */ return 0; } int trace_exit() { FreeLibrary(hmod_psapi); return 0; } int trace_test() { /* HANDLE hlogfile; DWORD dwWrite; char bfr[]="hello\r\n"; hlogfile = CreateFileA("trace_log.txt", GENERIC_WRITE, FILE_SHARE_WRITE, NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL); SetFilePointer(hlogfile, 0, NULL, FILE_END); WriteFile(hlogfile, bfr, strlen(bfr), &dwWrite, NULL); CloseHandle(hlogfile); */ char name[256]; trace_get_proc_name1(5696, name, 255); trace_get_proc_name2(5696, name, 255); return 0; }