I am trying to figure out if there is a way to basically install an application into a sandbox, so that I can easily see all files it created and all registry entries it added without searching the computer looking for files.
It doesn't need to be a sandbox, as long as it will tell me everything the installer has done. Surely there has to be something out there that does this. Je sais my A/v tells me when it accesses certain files and folders, but I am looking for a more precise approach that logs everything so I can analyze it after.
Existe-t-il un moyen de see all fichiers and registre entries that an application installers?
Re: Existe-t-il un moyen de see all fichiers and registre entries that an application installers?
-
Download, unpack and run [Process Monitor](http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx).
-
Run your installer. J'utilise [FileZilla](https://filezilla-project.org/) for this example.
-
While the installer runs, vous pouvez utiliser the crosshair and drag it onto the installer window. Cela va create a filter which results in Process Monitor only showing events relating to that process.
Vous pouvez aussi wait for the installer to finish and pick it out of the recorded events yourself. Vous pouvez faites un clic droit sur the **Process Name** and create an **Include** filter easily.
-
You will now have a log of every système de fichiers or registry access of the installer. Vous pouvez now create additional filters to further analyse the data or use the functions available from the **Tools** menu.
Especially **File Summary** and **Registry Summary** might be of interest in this context.
Cependant, note that when filtering events for a specific process only, you *might* miss operations that aren't directly caused by the installer process itself. The installer could call some Windows API that indirectly causes registry values to change.
Likewise, the installer could just spawn a child process that makes file and/or registry modifications. This child process also wouldn't be seen when you only filter on the parent process.
When a process spawns a child process, cela va be indicated by the **Process Create** operation in Process Monitor.
Download, unpack and run [Process Monitor](http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx).
-
Run your installer. J'utilise [FileZilla](https://filezilla-project.org/) for this example.
-
While the installer runs, vous pouvez utiliser the crosshair and drag it onto the installer window. Cela va create a filter which results in Process Monitor only showing events relating to that process.
Vous pouvez aussi wait for the installer to finish and pick it out of the recorded events yourself. Vous pouvez faites un clic droit sur the **Process Name** and create an **Include** filter easily.
-
You will now have a log of every système de fichiers or registry access of the installer. Vous pouvez now create additional filters to further analyse the data or use the functions available from the **Tools** menu.
Especially **File Summary** and **Registry Summary** might be of interest in this context.
Cependant, note that when filtering events for a specific process only, you *might* miss operations that aren't directly caused by the installer process itself. The installer could call some Windows API that indirectly causes registry values to change.
Likewise, the installer could just spawn a child process that makes file and/or registry modifications. This child process also wouldn't be seen when you only filter on the parent process.
When a process spawns a child process, cela va be indicated by the **Process Create** operation in Process Monitor.