0

I've got third party Winamp plug-in in windows, that should be able to load its datafile.

The datafile is located in same folder as the plug-in, but can not be found. My idea is that plug-in searches in some pre-defined path. So I need somehow to find out what file read attempt is done to place file in the appropriate place.

durron597
  • 31,968
  • 17
  • 99
  • 158
sukhmel
  • 1,402
  • 16
  • 29

1 Answers1

0

Best way to do this is to use Process Monitor from Sysinternals suite (http://technet.microsoft.com/sysinternals/bb896645)

Set up filters to watch only the examined program and look for 'CreateFile' operations, which are also read attempts.

sukhmel
  • 1,402
  • 16
  • 29
  • -1. Not exactly true. Is possible call CreateFile without reading. – Xearinox May 07 '13 at 19:18
  • @Xearinox, my point was that all readings will be CreateFile, not otherwise. Or is it possible to attempt read without CreateFile call? – sukhmel May 08 '13 at 07:48
  • First, yes is possible read without CreateFile using Nt/ZwReadFile. Also file may will be open with CreateFile without read attept, etc. for exclusive lock. – Xearinox May 09 '13 at 03:48
  • So, how should I improve the answer to make it correct? What is the full list of possible operations that may be invoked at file read attempt? – sukhmel May 09 '13 at 10:28
  • @Xearinox could you please suggest on how to improve the answer? – sukhmel May 13 '13 at 11:15