0

I have been unsuccessful at finding any reliable way to detect when a CD/DVD burn process starts. The burning tool will only be file explorer.

I know there is an event log "The IMAPI CD-Burning COM Service service was successfully sent a start control."

The problem with this is that this (and the corresponding stop) will be triggered even if a burn never took place. It seems certain things like WMP will trigger that event when you initialize (click on the burn tab).

What I need is a method (wmi, imapi, whatever) that will inform me anytime the burn process actually starts.

Unfortunately I do not know enough powershell to even know where to start looking. I am just googling wildly in the dark at this point hoping that someone did something close enough to what I want and have not yet been able to find anything.

Thank you,

Bob Arnson
  • 21,377
  • 2
  • 40
  • 47
itsme notyou
  • 1
  • 1

2 Answers2

0

You can monitor status of the write operation, but only in your own application: Monitoring Progress With Events

Several interfaces let you implement an event handler to receive progress information. For example, an event object can be attached to the data writer to receive status of the write operation.

However, there is no Pre-burn action:

there is no hook or callback to preprocess data being burned by someone else

The only thing that I could think of to monitor IMAPI system-wide, is to hook DLL calls:

Is it possible to hook a COM interface method using MadChook? Actually what I want to do is hook the IMAPI interface (IDiscMaster) for writing CDs. I want to hook the method RecordNow for that interface. Now this interface is implemented via imapi.exe and explorer does an out-of-proc call to this mentod using the proxy "Actxprxy.dll"

I have got around the issue by hooking CoCreateInstance and wrapping all the methods of IDiscMaster, but then I end up getting a lot of unnecessary hits to my hook as explorer call Cocreateinstance many times.

I'm writing a simple program that monitors the CD burning in windows explorer. I hooked IDiscMaster::RecordDisc in XP and IDiscFormat2Data::Write and it works fine. But if i burns CD as live file system, it doesn't be monitored.

  1. Which function should i hook?
  2. I hooked ICDBurn::Burn (this function has 0x10 offset from ICDBurn's vft). Whenever i popup menu to click , explorer failed and windows make shut down it. The error code is STATUS_STACK_BUFFER_OVERRUN.

But that's error-prone and requires some specific skills.

beatcracker
  • 6,714
  • 1
  • 18
  • 41
  • Thanks. That gives me some phrases to further my research. To be clearer I am not looking to modify the data, I only need to know when someone clicks "Burn to Disc" in file explorer. Even talking to file explorer via WMI calls to track that being clicked would solve my problem. For the event, I am not even sure how to get it in powershell. Here is a page that gives some info about the specific event http://www.hecfblog.com/2009/03/what-did-they-take-when-they-left-part.html I tried using Get-EventLog but everything I tried was invalid. – itsme notyou Mar 15 '16 at 18:01
  • I resolved the issue with get-eventlog. My biggest hurdle is that I am not a windows user so I dont know enough vocab yet to make meaningful searches. Get-EventLog system | where {$_.source -eq "cdrom"} Although I do not know if there is something better I should be looking for and this is not a total solution yet because I would have to periodically poll for the event instead of having some type of event filter tell me when it pops up. – itsme notyou Mar 15 '16 at 18:34
0

Thanks for the help. What I have discovered since asking is that at least in Windows 7 but possibly other versions of Windows does an exclusive lock on the CD drive just before it does a write. This is discussed in the IMAPI reference dox on MSFT. This is actually done by just about every burning app not just file explorer to prevent multiple things from messing up the write process.

An event is sent to System with the id code 133 by cdrom which can be monitored to detect when a burn is started. This event only seems to be generated when a burn starts and not by other things like those discussed in the OP.

The following code snippet will attach an event listener and when the event shows up it will react.

I do not know powershell or windows that well so if anyone has suggestions to make this example better I welcome suggestions This however appears to be functional.

$WMI = @{
    Query = "select * from __InstanceCreationEvent 
        where TargetInstance isa 'Win32_NtLogEvent' 
        and TargetInstance.logfile = 'System' 
        and TargetInstance.SourceName = 'cdrom' 
        and TargetInstance.EventCode = '133'"
    Action = {
    write-host "CD Burn started"
    }
}
$Null = Register-WMIEvent @WMI
itsme notyou
  • 1
  • 1