Is it possible to capture a "file not found" from another process and then return a file to that process?

Question

I have a legacy application that looks for files in a directory. It does not handle missing files very well. What I want to do is "capture" the file not found errors, and send another file back to the calling app instead. Similar to how you could handle a 404 error on a webserver and return something based on what the requested URL was, except on the local file system.

Is this possible? And more preferably, is it possible in .Net?

Answer 1

Yes what you described is possible.

I would suggest using a filesystem filter driver or mini filter for this type of thing though which can't be done in .Net.

The way I am suggesting is probably the most proper way that catches everything at the filesystem level.

Answer 2

You can do this by intercepting the call to Win API function CreateFile. This requires dll injection. In .NET you can use this library: easyhook.codeplex.com

Answer 3

If a commercial solution is acceptable, then something like Eldos CallbackFilter might fit the bill:

http://www.eldos.com/cbflt/spec.php

I haven't used it for exactly your purposes, but you can certainly intercept file system calls, where you could check if the file exists and create a dummy one if none exists.

This might prove to be a lot more straightforward for sorting out a badly behaving legacy application.

Answer 4

If you know where the code in the process that is going to open the file, you could write a wrapper process around it that acts like a debugger, intercept the call, check to see if it exists yourself, and if not, replace the filename with a different one.

Something like:

CreateProcess(bla bla, DEBUG_ONLY_THIS_PROCESS, bla bla);

SetBreakPoint(address of code to set breakpoint)
{
  ReadProcessMemory to save off byte for breakpoint
  WriteProcessMemory 0xCC to set breakpoint
  FlushInstructionCache
}

while (TRUE == bContinue)
{
  bContinue = WaitForDebugEvent(&debugEvent);
  switch (dwDebugEventCode)
  {
    case EXCEPTION_BREAKPOINT:
      // Read the file name from memory, check if it exists, if not, replace it with
      // new file name using the same length in memory :)
      // Replace your code byte you read out when you set the breakpoint
  }
}

Another method is to overwrite the function call table with your own call to CreateFile (or whatever they are using in the app in question). Look up API hooking, or even Dll injection may help you out here.

Microsoft has the Detours package that can help you out, and CodePlex has the EasyHook that looks quite interesting.