I need help by using the ReadDirectoryChangesW API.

[Dark_C0der]

Hi. Sorry for my Bad English!!!

I need help by using the ReadDirectoryChangesW API.

This is my ASM code:

.386
.model flat,stdcall
option casemap:none

include kernel32.inc
include user32.inc
include windows.inc
include masm32rt.inc
include masm32.inc
includelib masm32.lib
includelib user32.lib
includelib kernel32.lib


.data

dir db "c:\",0


buffer db 5000 dup (?)

.data?

hdir dd ?

.code
start:

call AllocConsole

invoke CreateFile,addr dir,GENERIC_READ or GENERIC_WRITE,FILE_SHARE_READ or FILE_SHARE_WRITE or FILE_SHARE_DELETE,0,OPEN_EXISTING,FILE_FLAG_BACKUP_SEMANTICS,0
mov hdir,eax

invoke ReadDirectoryChangesW,hdir,addr buffer,sizeof buffer,TRUE,FILE_NOTIFY_CHANGE_FILE_NAME,10ABFh,0,0



invoke ExitProcess,0

end start

...when I change a file like this (test_new to test_old)

My debugger shows me this on the buffer offset

00403000  63 3A 5C 00 30 00 00 00  㩣\0.
00403008  04 00 00 00 22 00 00 00  .".
00403010  74 00 65 00 73 00 74 00  test
00403018  5C 00 74 00 65 00 73 00  \tes
00403020  74 00 5F 00 6E 00 65 00  t_ne
00403028  77 00 2E 00 74 00 78 00  w.tx
00403030  74 00 00 00 00 00 00 00  t...
00403038  05 00 00 00 22 00 00 00  .".
00403040  74 00 65 00 73 00 74 00  test
00403048  5C 00 74 00 65 00 73 00  \tes
00403050  74 00 5F 00 6F 00 6C 00  t_ol
00403058  64 00 2E 00 74 00 78 00  d.tx
00403060  74 00 00 00 00 00 00 00  t...


how can I evaluate these data in order to use them??

StringSplit?? or there are other techniques for filtering...

[dedndave]

not the answer you are looking for, but you can get rid of some warning messages

remove these lines

Code Select Expand

.386
.model flat,stdcall
option casemap:none

include kernel32.inc
include user32.inc
include windows.inc

and these lines

Code Select Expand

include masm32.inc
includelib masm32.lib
includelib user32.lib
includelib kernel32.lib

you only need this line...

Code Select Expand

include masm32rt.inc

Hutch has recently published a set of unicode tools that may be helpful
use the forum search tool - Advanced Search - search term: "unicode", user name: "hutch--"

however, there are some other values in the FILE_NOTIFY_INFORMATION structure
http://msdn.microsoft.com/en-us/library/aa364391%28v=vs.85%29.aspx

[Dark_C0der]

Thank's dedndave for your help :)

I've done it now it works.
I now have only one other problem:

Occurred when I now run the API, it'll wait until an event is.

Could it perhaps run it in a thread?

[Sorry for my bad english :)]