i need to hook a file saved from windows7 executable. Im python

Question

I need to get the output of an executable ( think notepad.exe) then capture the save file. I have found some documentation which would help but I cannot implement due to 0 experience with c++.
http://j00ru.vexillium.org/syscalls/nt/64/
https://github.com/jingpu/pintools/blob/master/source/tools/ManualExamples/strace.cpp
https://software.intel.com/sites/landingpage/pintool/docs/71313/Pin/html/

Answer 1

@Jason, I see your code, but honestly, I only get very little of it, anyway I see that you're code was meant to launch the craftware app, but you didn't specify any command line arguments to pass, I thought you would pass a file name for it to process or something? how craftware knows which file it should work on?

I googled about craftware to find that is an app for transforming 3d objects into digital file? I don't really understand their intro.

Answer 2

@Jason, sounds tough, I'm afraid it's far beyond my knowledge, anyway, if you don't mind me asking (again), what are the works that done manually, and how's your plan for automating the manual works, I can understand you're very busy with this, just couldn't help the curiosity.

Answer 3

@Jason, best of luck on the project, sorry I can't help you with that, maybe if I find something, and you're still working on it, I'll pass it on. Thanks for sharing :)

Answer 4

May I ask what is it exactly that you want to do that makes you need to use system calls? I may not be able to help, just asking for curiosity?

Answer 5

You want to use python to run an exe and get its result?

If so look at the subprocess module.
https://docs.python.org/3/library/subprocess.html

Answer 6

https://en.m.wikipedia.org/wiki/Hooking

http://www.cnblogs.com/LittleHann/p/6133733.html

https://github.com/srw/windows-api-hooking-in-JUMP_LINK__&&__python__&&__JUMP_LINK-with-deviare-sample

https://www.apriorit.com/dev-blog/160-apihooks

https://www.codeproject.com/Articles/30537/Windows-File-Monitoring-System-Using-Windows-API-H

http://timgolden.me.uk/python/win32_how_do_i/watch_directory_for_changes.html

http://chimera.labs.oreilly.com/books/1230000000393/ch05.html#_solution_75

https://www.google.com/url?sa=t&source=web&rct=j&url=http://winappdbg.sourceforge.net/dist/winappdbg-1.5-tutorial.pdf&ved=0ahUKEwigyIzntdPWAhXij1QKHQFmCoYQFghBMAg&usg=AOvVaw2KY3gwJNP1oeQ5TdGNHIMG !Downloads a PDF!

https://www.google.com/url?sa=t&source=web&rct=j&url=https://readthedocs.org/projects/pyfilesystem/downloads/pdf/latest/&ved=0ahUKEwjen-bDudPWAhUHslQKHd0MDAMQFghlMAc&usg=AOvVaw0XGR9ffebJzL7S78HOe5IJ !Downloads PDF!

various documentation on hooking, not all are relevant to what I'm trying to accomplish. createfile seams promising?