在Windows上建立一个开源的强制访问控制框架及SDK。使Windows平台的应用开发者，可以不用关心操作系统底层技术，只用进行简单的SDK调用或配置就可以保护自己的应用程序。
// 包含头文件
#include "sewindows.h"
// 定义导出函数
typedef BOOLEAN(*fsewin_init)();
typedef BOOLEAN(*fsewin_setoption)(int mode, int type);
typedef BOOLEAN(*fsewin_register_opt)(struct sewin_operations *ops);
fsewin_init monitor_sewin_init;
fsewin_setoption monitor_sewin_setoption;
fsewin_register_opt monitor_sewin_register_opt;
// 从动态库sewindows.dll中导出接口函数
HMODULE handle;
handle = LoadLibrary(_T("sewindows.dll"));
monitor_sewin_init = (fsewin_init)GetProcAddress(handle, "sewin_init");
monitor_sewin_setoption = (fsewin_setoption)GetProcAddress(handle, "sewin_setoption");
monitor_sewin_register_opt = (fsewin_register_opt)GetProcAddress(handle, "sewin_register_opt");
if (monitor_sewin_init == NULL || monitor_sewin_setoption == NULL || monitor_sewin_register_opt == NULL)
{
exit(0);
}
BOOLEAN bret = monitor_sewin_init();
if ( !bret )
{
exit(0);
}
// 设置模式为“通知模式”，设置类型为“文件(夹)”操作
monitor_sewin_setoption(SEWIN_MODE_NOTIFY, SEWIN_TYPE_FILE);
//我们先定义一个自己的回调函数，用来打印文件创建操作的信息
BOOLEAN monitor_file_create(WCHAR *user_name, WCHAR *process, WCHAR *file_path)
{
wprintf(_T("User=%s, Process=%s, file=%s\n"), user_name, process, file_path);
return TRUE;
}
// 注册monitor_file_create到SDK中
sewin_operations ops;
memset(&ops, 0x00, sizeof(struct sewin_operations));
ops.file_create = monitor_file_create;
monitor_sewin_register_opt(&ops);
将编译的exe文件和sewindows.sys，sewindows.dll拷贝到同一个目录，运行exe，就可以看到下面效果啦:
User=LZF-A87A7288234\Administrator, Process=C:\WINDOWS\explorer.exe, file=C:\新建 文本文档.txt
User=LZF-A87A7288234\Administrator, Process=C:\WINDOWS\explorer.exe, file=C:\新建 RTF 文档.rtf
User=LZF-A87A7288234\Administrator, Process=C:\WINDOWS\explorer.exe, file=C:\新建 写字板文档.doc
注:
回调函数的调用过程是多线程的，所有如果你的回调函数中有公用的内容，需要自己处理好同步。
下面是一个完整的示例，演示了使用SDK对文件的创建操作进行通知，并在用户自定义函数中打印了收到的
操作详细信息。
/*
notify_example : print file create
--dir-------notify_example.exe
|----sewindows.sys
|----sewindows.dll
*/
#include <stdio.h>
#include <tchar.h>
#include <locale.h>
#include <windows.h>
#include "sewindows.h"
#pragma comment(lib,"Advapi32.lib")
#pragma comment(lib,"User32.lib")
typedef BOOLEAN(*fsewin_init)();
typedef BOOLEAN(*fsewin_setoption)(int mode, int type);
typedef BOOLEAN(*fsewin_register_opt)(struct sewin_operations *ops);
fsewin_init monitor_sewin_init;
fsewin_setoption monitor_sewin_setoption;
fsewin_register_opt monitor_sewin_register_opt;
BOOLEAN monitor_file_create(WCHAR *user_name, WCHAR *process, WCHAR *file_path)
{
wprintf(_T("User=%s, Process=%s, file=%s\n"), user_name, process, file_path);
return TRUE;
}
int _tmain(int argc, TCHAR * argv[])
{
int ret = 0;
sewin_operations ops;
HMODULE handle;
setlocale(LC_ALL, "chs");
// step1. loadLibrary sewindows.dll
handle = LoadLibrary(_T("sewindows.dll"));
monitor_sewin_init = (fsewin_init)GetProcAddress(handle, "sewin_init");
monitor_sewin_setoption = (fsewin_setoption)GetProcAddress(handle, "sewin_setoption");
monitor_sewin_register_opt = (fsewin_register_opt)GetProcAddress(handle, "sewin_register_opt");
if (monitor_sewin_init == NULL || monitor_sewin_setoption == NULL || monitor_sewin_register_opt == NULL)
{
return -1;
}
// step2. init sewindows
BOOLEAN bret = monitor_sewin_init();
if ( !bret )
{
return -2;
}
// step3. set options
//monitor_sewin_setoption(SEWIN_MODE_INTERCEPT, SEWIN_TYPE_FILE|SEWIN_TYPE_PROC|SEWIN_TYPE_REG);
monitor_sewin_setoption(SEWIN_MODE_NOTIFY, SEWIN_TYPE_FILE);
// step4. register callbak functions
memset(&ops, 0x00, sizeof(struct sewin_operations));
ops.file_create = monitor_file_create;
monitor_sewin_register_opt(&ops);
printf("Start Working (Ctrl + 'C' to exists) ...\n");
while(1){
Sleep(3000);
}
return 0;
}