Мониторинг файлов в папке

#include <windows.h>
#include <Dbghelp.h>
#include <fstream>
 
HANDLE hCreateFile(LPCTSTR, DWORD, DWORD, LPSECURITY_ATTRIBUTES, DWORD, DWORD, HANDLE);
HANDLE htstCreateFile(LPCTSTR, DWORD, DWORD, LPSECURITY_ATTRIBUTES, DWORD, DWORD, HANDLE);
 
PVOID HookImportedFunction(const char *Dll, const char *FuncName, void *Function);
DWORD HookGeneralFunction(const char *Dll, const char *FuncName, void *Function, unsigned char *backup);
void NumOut(char *format, ...);
 
DWORD createFileAddr=0;
BYTE backup[6];
ofstream fout("C:\\dll.txt");
 
BOOL APIENTRY DllMain( HMODULE hModule, DWORD  fwReason, LPVOID lpReserved)
{
 
    switch (fwReason)
    {
        case DLL_PROCESS_ATTACH:
            {   
                DisableThreadLibraryCalls(hModule); //keeps it from being re-called
                fout << "In DLL process Attach" << endl;
                //HookImportedFunction("Kernel32.dll", "CreateFileA", hCreateFile);
                createFileAddr = HookGeneralFunction("Kernel32.dll", "CreateFileA", hCreateFile, backup);
                return true;
 
            }
            break;
        case DLL_THREAD_ATTACH:
            fout << "In DLL thread Attach" << endl;
            break;
        case DLL_THREAD_DETACH:
            fout << "In DLL thread detach" << endl;
            fout.close();
            break;
        case DLL_PROCESS_DETACH:
            {
                fout << "In DLL Process Detach" << endl;
 
                if(createFileAddr)
                    WriteProcessMemory(GetCurrentProcess(), (void*)createFileAddr, backup, 6, 0);
 
                fout.close();
                return true;
 
            }
            break;
    }
    return false;
}
 
HANDLE hCreateFile(LPCTSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile)
{
 
    fout << "Function call to CreateFileA and lpFilename is " << lpFileName << endl;
    
    HANDLE fHandle = CreateFile(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile);
 
    fout << "The File handle is " << fHandle << endl;
 
    return fHandle;
}
 
 
 
HANDLE htstCreateFile(LPCTSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile)
{
    
    //restore the bytes at MessageBox
    WriteProcessMemory(GetCurrentProcess(), (void*)createFileAddr, backup, 6, 0);
    
    //use the true msgbox
    //MessageBox(0, "Incoming Text", "HOOKED hihi!", 0);
    HANDLE ret = CreateFile(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile);
 
    //restore the hook
    createFileAddr = HookGeneralFunction("kernel32.dll", "CreateFileA", htstCreateFile, backup);
    return ret;
}