In Windows, how can I trace in C which files a child process reads and writes?

Question

My goal is to determine when executing a command, precisely which files it reads and writes. On Linux I can do this using ptrace (with work, akin to what strace does) and on FreeBSD and MacOS I can do this with the ktrace system command. What would you use to obtain this information on Windows?

My research so far suggests that I either use the debugger interface (similar to ptrace in many ways) or perhaps ETW. A third alternative is to interpose a DLL to intercept system calls as they are made. Unfortunately, I don't have the experience to guess as to how challenging each of these approaches will be.

Any suggestions?

Answer 1

As you suggested, this is a fairly simple task to solve with API hooking with DLL injection.

This is a pretty good article about the application: API hooking revealed

I believe you can find more recent articles about the issue.

However, you probably need to use C++ to implement such a utility. By the way, programs can disable DLL injection. For example, I weren't able to use this approach on the trial version of Photoshop.

So, you may want to check if you can inject DLL files in the process you want with an existing solution before you start writing your own.

Answer 2

Unfortunately it seems there is no easy way to intercept file level operations on Windows.

Here are some hints:

• you could try to use FileMon from Sysinternals if it is enough for your needs, or try to look at the source of the tool
• you could make use of commercial software like Detours - beware, I never used that myself and I'm not sure it really meets your needs

If you want a better understanding and are not frightened at doing it by hand, the Windows way of intercepting file I/O is using a File System Filter Driver. In fact, there is a FilterManager embedded in Windows system that can forward all file system calls to minifilters.

To build it, the interface with the system is provided by the FilterManager, and you have just (...) to code and install the minifilter that does the actual filtering - beware again never tested that ...