Actually I’m working on a particular application that as first instance needs to monitor the
activity of certain functions, such as CreateFile(), ReadFile(), WriteFile
Especially this last API, cause all communications between a Device Driver and the UserMode application, are accomplished by IOTCLs that are sent with DeviceIoControl().
So essentially we need to implement an API Monitoring application, and this can be done by hooking the wanted API and using next an empty Trampoline function, just to grab the used parameters.
The most intersting hooking are:
Microsoft’s Detour -> http://research.microsoft.com/sn/detours/
Deviare -> http://www.nektra.com/products/deviare/index.php
My suggestion is to use Deviare or Mini-HookEngine are really easy and powerful! 😉