<p>I am trying to snoop on a log file that an application is writing to.</p>
<p>I have successfully hooked createfile with the detours library from MSR, but createfile never seems to be called with file I am interested in snooping on.  I have also tried hooking openfile with the same results.</p>
<p>I am not an experienced Windows/C++ programmer, so my initial two thoughts were either that the application calls createfile before I hook the apis, or that there is some other API for creating files/obtaining handles for them.</p>

[{'answer_id': 13849, 'author': 'Community', 'author_id': -1, 'author_profile': 'https://Stackoverflow.com/users/-1', 'pm_score': 3, 'selected': False, 'text': '<p>Here\'s a link which might be of use:</p>\n\n<p><a href="http://www.codingthewheel.com/archives/how-i-built-a-working-online-poker-bot-6" rel="nofollow noreferrer">Guerilla-Style File Monitoring with C# and C++</a></p>\n\n<p>It is possible to create a file without touching CreateFile API but can I ask <strong>what DLL injection method you\'re using</strong>? If you\'re using something like Windows Hooks your DLL won\'t be installed until sometime after the target application initializes and you\'ll miss early calls to CreateFile. Whereas if you\'re using something like DetourCreateProcessWithDll your CreateFile hook can be installed prior to any of the application startup code running.</p>\n\n<p>In my experience 99.9% of created/opened files result in a call to CreateFile, including files opened through C and C++ libs, third-party libs, etc. Maybe there are some undocumented DDK functions which don\'t route through CreateFile, but for a typical log file, I doubt it.</p>\n'}, {'answer_id': 13870, 'author': 'Barak Schiller', 'author_id': 1651, 'author_profile': 'https://Stackoverflow.com/users/1651', 'pm_score': 4, 'selected': True, 'text': '<p>You can use Sysinternal\'s <a href="http://technet.microsoft.com/en-us/sysinternals/bb896642.aspx" rel="nofollow noreferrer">FileMon</a>. \nIt is an excellent monitor that can tell you exactly which file-related system calls are being\nmade and what are the parameters.</p>\n\n<p>I think that this approach is much easier than hooking API calls and much less intrusive.</p>\n'}, {'answer_id': 45435, 'author': 'botismarius', 'author_id': 4528, 'author_profile': 'https://Stackoverflow.com/users/4528', 'pm_score': 2, 'selected': False, 'text': '<p><a href="http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx" rel="nofollow noreferrer">Process Monitor</a> from sysinternals could help too.</p>\n'}]
['https://Stackoverflow.com/questions/13806', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/1646/']