Member Avatar for z_zendegi

hi everybody
I have a program and want to khnow which files open or access when program run.
when for first time run this program in a pc, it get from user som information and save them(s.th like db name and ip address)
I want to find where is this information save on os or pc???

  • 3 Contributors
  • 2 Replies
  • 85 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by Emilyalice

Dani AI

Generated

As described, the app asks for a database name and IP on first run. As suggested, Process Monitor is the right way to observe what the program actually writes and where. Process Monitor (Procmon) captures real-time file and registry activity so the exact path or key that stores those values becomes visible.

A simple workflow to reproduce the first-run save and find the storage:

  1. Download and run Process Monitor (Process Monitor) with elevated rights and clear the current display.
  2. Add a filter: Process Name is the target executable (include). Optionally add filters for Operation is WriteFile and Operation is RegSetValue to reduce noise.
  3. Start capture, run the program, enter the DB name and IP, and let the app finish saving its settings.
  4. Stop capture and use Procmon's Find to search for the actual DB name or IP string. Double-click matching events to see full Path or registry Detail.
  5. Note the exact file path or registry key shown; back up the file or export the key before editing.

Common storage places to check (XP-era and later): per-user AppData (C:\Documents and Settings\<User>\Application Data\... on XP), local profile Local Settings\Application Data, all-users data (C:\Documents and Settings\All Users\Application Data on XP), the program folder, and registry keys under HKCU\Software\ or HKLM\Software\. If Procmon shows writes but contents are not plain text, the app may encrypt the values or send them to a server — in that case inspect network activity with a network tool or look for DPAPI/credential APIs.

Recommended Answers

All 2 Replies

Member Avatar for gerbil

Get Procmon from Technet.

Member Avatar for Emilyalice

Nowadays is very poppular.More and more people tend to buy things at home through the Internet.

Edited by Emilyalice
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.