Windows: How to intercept Win32 disk I/O API

Question

On Windows, all disk I/O ultimately happens via Win32 API calls like CreateFile, SetFilePointer, etc.

Now, is it possible to intercept these disk I/O Win32 calls and hook in your own code, at run time, for all dynamically-linked Windows applications? That is, applications that get their CreateFile functionality via a Windows DLL instead of a static, C library.

Some constraints that I have are:

1. No source code: I won't have the source code for the processes I'd like to intercept.

2. Thread safety: My hook code may dynamically allocate its own memory. Further, because this memory is going to be shared with multiple intercepted processes (and their threads), I'd like to be able to serialize access to it.

3. Conditional delegation and overriding : In my hook code, I would like to be able to decide whether to delegate to the original Win32 API functionality, or to use my own functionality, or both. (Much like the optional invocation of the super class method in the overriding method of the subclass in C++ or Java.)

4. Regular user-space code: I want to be able to accomplish the above without having to write any device-driver, mainly due to the complexity involved in writing one.

If this is possible, I'd appreciate some pointers. Source code is not necessary, but is always welcome!

Answer 1

You may want to look into mhook if Detours isn't what you want.

Here are a couple of problems you may run into while working with hooks:

• ASLR can prevent injected code from intercepting the intended calls.
• If your hooks are global (using AppInit_DLLs for example), only Kernel32.dll and User32.dll are available when your DLL is loaded. If you want to target functions outside of those modules, you'll need to manually make sure they're available.