Any Windows APIs to get file handles besides createfile and openfile?

Question

I am trying to snoop on a log file that an application is writing to.

I have successfully hooked createfile with the detours library from MSR, but createfile never seems to be called with file I am interested in snooping on. I have also tried hooking openfile with the same results.

I am not an experienced Windows/C++ programmer, so my initial two thoughts were either that the application calls createfile before I hook the apis, or that there is some other API for creating files/obtaining handles for them.

Cryptonymous

Answer 1

You can use Sysinternal's FileMon. It is an excellent monitor that can tell you exactly which file-related system calls are being made and what are the parameters.

I think that this approach is much easier than hooking API calls and much less intrusive.

Hindmost

Filemon, and its sister application Regmon are great stuff – Lurcher

FileMon has been superceded by ProcMon (technet.microsoft.com/en-us/sysinternals/bb896645.aspx) – Splurge

Answer 2

Here's a link which might be of use:

Guerilla-Style File Monitoring with C# and C++

It is possible to create a file without touching CreateFile API but can I ask what DLL injection method you're using? If you're using something like Windows Hooks your DLL won't be installed until sometime after the target application initializes and you'll miss early calls to CreateFile. Whereas if you're using something like DetourCreateProcessWithDll your CreateFile hook can be installed prior to any of the application startup code running.

In my experience 99.9% of created/opened files result in a call to CreateFile, including files opened through C and C++ libs, third-party libs, etc. Maybe there are some undocumented DDK functions which don't route through CreateFile, but for a typical log file, I doubt it.

Archean

Answer 3

Process Monitor from sysinternals could help too.

Deferral