有的时候某个文件(文本文件,动态库,静态库)被修改或者破环,你需要
监控是哪个进程对你监控的文件或者目录进行了修改或者破坏。
当然你要是遇到某些分区被修改了,就无能为力了。
首先看下效果图,加入我们现在要监控的是 /data/hello.txt 这个文件,当然你也可以监控一个目录:
当我们: adb shell cat /data/hello.txt 的时候,我们就可以监控文件系统的操作(如:open , modiefie , close)。
目前可以监控的文件系统的时间列表:
inotify_event_array= [ ["File was accessed",1],\
["File was modified",1],\
["File attributes were changed",1],\
["writtable file closed",1],\
["Unwrittable file closed",1],\
["File was opened",1],\
["File was moved from X",1],
["File was moved to Y",1],\
["Subfile was created",1],\
["Subfile was deleted",1],\
["Self was deleted",1],\
["Self was moved",1],\
"Backing fs was unmounted",\
"Event queued overflowed",\
"File was ignored"];
你可以通过事件左边的checkBox,打开或者屏蔽相关事件。