Hooking file open

[Farshid Lashkari]

Hi,

My goal is to detect all (or most) file dependencies of a script (i.e.
modules, dlls, data files). Currently, after a script is finished
executing I use sys.modules to determine all module dependencies, and I
use win32process.EnumProcessModules to determine DLL dependencies. This
works reasonably well, however I would still like to detect dependencies
from regular file open calls.

I did a little test by modifying __builtins__.open to point to a custom
function that forwards the call to the original open function and saves
the filename to a list. It seemed to work for simple test cases. Here is
the code:

def open_hook(*args,**kwargs):
r = open_real(*args,**kwargs)
saveFileName(args[0])
return r

open_real = __builtins__.open
__builtins__.open = open_hook

Is this a safe approach? Is there a more efficient way of doing this? I
realize that some dependencies will still fall through my checks,
especially file opens from C extensions, which is fine. I just want to
be able to detect the most common use cases. Any other suggestions are
appreciated.

-Farshid

[Dale Strickland-Clark]

You might consider trapping calls to file() too, which is an alias for
open().

Also, I think I'd do my logging before calling the real function. It depends
how you want to deal with exceptions.

Farshid Lashkari wrote:

Hi,

My goal is to detect all (or most) file dependencies of a script (i.e.
modules, dlls, data files). Currently, after a script is finished
executing I use sys.modules to determine all module dependencies, and I
use win32process.EnumProcessModules to determine DLL dependencies. This
works reasonably well, however I would still like to detect dependencies
from regular file open calls.

I did a little test by modifying __builtins__.open to point to a custom
function that forwards the call to the original open function and saves
the filename to a list. It seemed to work for simple test cases. Here is
the code:

def open_hook(*args,**kwargs):
r = open_real(*args,**kwargs)
saveFileName(args[0])
return r

open_real = __builtins__.open
__builtins__.open = open_hook

Is this a safe approach? Is there a more efficient way of doing this? I
realize that some dependencies will still fall through my checks,
especially file opens from C extensions, which is fine. I just want to
be able to detect the most common use cases. Any other suggestions are
appreciated.

-Farshid

--
Dale Strickland-Clark
Riverhall Systems - www.riverhall.co.uk

[Farshid Lashkari]

Dale Strickland-Clark wrote:

You might consider trapping calls to file() too, which is an alias for
open().

Thanks, I didn't know about that.

Also, I think I'd do my logging before calling the real function. It depends
how you want to deal with exceptions.

I placed the logging after the call to the real function so that files
that don't exist will not be logged. However, I'm already checking for
file existence during the post process of the script running, so I guess
it doesn't really make too much of a difference.

Thanks for the help.

-Farshid

[Carl Banks]

Dale Strickland-Clark wrote:

You might consider trapping calls to file() too, which is an alias for
open().

Also, I think I'd do my logging before calling the real function. It depends
how you want to deal with exceptions.

OP should hook into os.open as well. Plus, I don't think the database
modules (dbm, gdbm, bsddb) use Python open, so might want to hook into
those as well. You have be careful with extension modules; they often
open files their own way.
Carl Banks