Click here to Skip to main content
12,762,900 members (36,016 online)
Rate this:
Please Sign up or sign in to vote.
See more: C# PInvoke
I want to say a little about my idea, I want to hook the DeleteFile win32 API function in explorer.exe to intercept the deleting action, if someone deletes a file, a dialog box will pop up to ask for password, if the password is correct that one should be able to delete the file, if not the file will be protected from unauthorized user.

Firstly, I've done the hooking in Win7 and it failed then I tried the hooking in WinXP and it worked well except that when the user chooses Cancel, the file, in fact, is not deleted (that's what I want because user cancels his deleting operation), but the file is hidden right after user choosing Cancel from the dialog box. I have to press F5 (Refresh the window containing the file) to make it visible again. If don't do that, the user may think the file is deleted no matter what he chooses from the dialog. It is a little nasty to me. I tested the hooking on a Virtual machine installed with Win XP. I hope it should work well on a real machine. But this is not a serious problem to me. I think I've done the hooking successfully in Win XP. My serious problem is for Win 7.

For Win 7, my code even can't create a hook into explorer.exe, because right after the LocalHook.Create() is called, explorer.exe will be restarted, there is no exception raised. Because it is restarted so the hook is failed. I tried hooking CreateFile instead (this is from a sample code on EasyHook) and the hooking works well (explorer.exe doesn't restart). I don't know why explorer.exe restarts, there is no exception so it is really difficult for me to know, even debugging can't help (with my debugging skill), now here is a little of my inject dll code (the code for the main interface works well, it injects the dll successfully, because I can see some message sent from dll code, but the dll code which creates LocalHook fails):

public void Run(RemoteHooking.IContext icontext, string channel)
                hook = LocalHook.Create(LocalHook.GetProcAddress("kernel32.dll", "DeleteFileW"), new DeleteFileHandler(DeleteFileHookInstance), this); //It stops here, the main interface receives the reported status 'Creating...' seemly forever, I understand that is for the unexpected restarting of explorer.exe
                hook.ThreadACL.SetExclusiveACL(new int[] { 0 });
            catch (Exception ex)
                mainInterface.ShowStatus("CreateHook failed: " + ex.Message);
            while (true) { System.Threading.Thread.Sleep(500); }

[DllImport("kernel32.dll", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.StdCall)]
private static extern int DeleteFile(string filename);
[UnmanagedFunctionPointer(CallingConvention.StdCall, CharSet = CharSet.Unicode)]
private delegate int DeleteFileHandler(string filename);
private static bool deleted = false;
private int DeleteFileHookInstance(string filename)
            if (deleted)
                deleted = false;
                return 1;
            if (MessageBox.Show("Do you really want to delete file " + filename + "?", "Confirm delete file", MessageBoxButtons.YesNo, MessageBoxIcon.Question) == DialogResult.Yes)
                deleted = true;
                return DeleteFile(filename);
            else return 1;//Assume the call is successfull

Please help me out, your help would be highly appreciated!
Posted 15-Jan-13 2:05am
Updated 15-Jan-13 2:23am

1 solution

Rate this: bad
Please Sign up or sign in to vote.

Solution 1

This sort of problems always happen when using hooks. Actually I don't know the answer. It may be a problem with CPU architect or a change in DeleteFile API in new version. But I can suggest other ways.

1) You can go for NtSetFileInformation. It is an undocumented API but you can find needed info by searching the web. It is one of lowest APIs on a file deletion process and it can prevent deletion even in lower level than DeleteFile
2) Try to implement ICopyHook:[^][^]
ICopyHook implementation[^]
Using this you can prevent deletion from explorer (ONLY EXPLORER AND WHERE SHELL EXTENSIONS APPLY) without even hooking. Very clean way.

But you may have some difficulties with both ways.

3) Hardest way is to go for Drivers. This is not possible in C#.[^]

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

    Print Answers RSS
Top Experts
Last 24hrsThis month

Advertise | Privacy | Mobile
Web01 | 2.8.170217.1 | Last Updated 20 Jan 2013
Copyright © CodeProject, 1999-2017
All Rights Reserved. Terms of Service
Layout: fixed | fluid

CodeProject, 503-250 Ferrand Drive Toronto Ontario, M3C 3G8 Canada +1 416-849-8900 x 100