Como sei o que vai mudar no meu computador Windows antes de executar um programa?
I want to see the registry changes which will take action, which files are going to get changed, which new files are going to be added, etc
Isso não é possível:
-
Se você analisou o programa .exe e sabia quais chamadas de sistema ele pode fazer, você teria que fornecer todas as entradas possíveis para prever o que aconteceria quando fosse executado.
-
Existe um número infinito de entradas possíveis (considere apenas o caso simples de digitar caracteres aleatórios em um arquivo de texto, existem milhões de combinações possíveis).
-
No caso específico de "quais novos arquivos serão adicionados", nada pode saber de antemão o nome do arquivo que você vai dar ao programa para salvar um arquivo.
O melhor que você pode fazer é executar o programa (talvez em uma sandbox) e monitorar as alterações à medida que acontecem .
Existem várias possibilidades para esse monitoramento. O mais útil é provavelmente Process Monitor , pois fornece muitas informações que podem ser registradas. p>
De Nirsoft :
FolderChangesView is a simple tool that monitors the folder or disk drive that you choose and lists every filename that is being modified, created, or deleted while the folder is being monitored.
You can use FolderChangesView with any local disk drive or with a remote network share, as long as you have read permission to the selected folder.
ProcessActivityView creates a summary of all files and folders that the selected process tries to access. For each file that the process access, the following information is displayed: Number of times that the file was opened and closed, number of read/write calls, total number of read/write bytes, the dll that made the last open-file call, and more...
De SystemInternals :
Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity.
It combines the features of two legacy Sysinternals utilities, Filemon and Regmon, and adds an extensive list of enhancements including rich and non-destructive filtering, comprehensive event properties such session IDs and user names, reliable process information, full thread stacks with integrated symbol support for each operation, simultaneous logging to a file, and much more.
Process Explorer shows you information about which handles and DLLs processes have opened or loaded.
The Process Explorer display consists of two sub-windows. The top window always shows a list of the currently active processes, including the names of their owning accounts, whereas the information displayed in the bottom window depends on the mode that Process Explorer is in: if it is in handle mode you'll see the handles that the process selected in the top window has opened; if Process Explorer is in DLL mode you'll see the DLLs and memory-mapped files that the process has loaded.
Avisodeisenção
Nãosouafiliadoa