Home/ Questions/Q 31817
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-10T13:39:52+00:00

I am trying to snoop on a log file that an application is writing

  • 0

I am trying to snoop on a log file that an application is writing to.

I have successfully hooked createfile with the detours library from MSR, but createfile never seems to be called with file I am interested in snooping on. I have also tried hooking openfile with the same results.

I am not an experienced Windows/C++ programmer, so my initial two thoughts were either that the application calls createfile before I hook the apis, or that there is some other API for creating files/obtaining handles for them.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. You can use Sysinternal’s FileMon. It is an excellent monitor that can tell you exactly which file-related system calls are being made and what are the parameters.

    I think that this approach is much easier than hooking API calls and much less intrusive.

    • 0