WIN32 API override (Specifically CreateFile) in C#

Question

5.00/5 (1 vote)

See more:

Hello, I'm hoping someone might be able to help out. I've been looking for a few days now for a way to intercept all calls to CreateFile for a specific process name, and force that call to be in shared read only mode. I am aware that most programs lock a file for a reason. I am also aware that the program only reads from the file, and does not need to be locked. I plan on opening the file with read only and locking the file to read only.

I have found many different methods, most if not all being outdated, or I just could not get them to properly override the call.

While it would be very appreciated, I don't need complete source code, and I'm not asking for any hand holding. I just need a nudge in the proper direction!

Thank you for any help you can offer!

NOTE: While the name of the function I want to override is CreateFile, it will actually open an existing file instead of creating a new one.

Posted 5-Nov-11 6:19am

KairuByte

Updated 5-Nov-11 11:07am

v3

Add a Solution

2 solutions

Solution 1

That makes no sense at all. If a process is creating the file, it CAN'T be opened in read-only mode. What I think you mean is that you want to set the file to exclusive-write mode so no other apps can write to it.

Posted 5-Nov-11 7:03am

#realJSOP

Comments

KairuByte 5-Nov-11 13:18pm

While that is what the function name suggests, that is not the case. CreateFile either creates the file (or I/O device) if it does not exist, or opens the file (or I/O device) if it is already present.

In this case the file is most definitely always present, though I suppose I could throw in a check beforehand just to make sure.

Here is Microsoft's documentation on CreateFile: msdn.microsoft.com/en-us/library/windows/desktop/aa363858(v=vs.85).aspx

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Valery Possoz · Accepted Answer · 2011-11-05T13:29:00

Solution 2

Hello,

Have you looked at WinApi Hooks?

This article uses CreateFile to demonstrate api hooking :D

EasyHook - The reinvention of Windows API hooking[^]

Valery.

Posted 5-Nov-11 13:29pm

Valery Possoz

Comments

KairuByte 5-Nov-11 21:12pm

That one may work.... It seems to be a slightly different version of something I looked at earlier today. I'll test it out and get back to you! ^_^

KairuByte 7-Nov-11 8:49am

Checking it out now, first chance I have had. It does seem to actually compile, which the previous version I had seen did not. Looks promising!

KairuByte 7-Nov-11 10:08am

That works quite well! Now I just need to figure out a way to inject into a process before it starts, without needing to start the process from my project... Maybe hooking explorers process start? Anyway, thanks!