Low-overhead I/O monitoring on Windows

Question

I would like a low-overhead method of monitoring the I/O of a Windows process.

I got several useful answers to http://stackoverflow.com/questions/864839/monitoring-certain-system-calls-done-by-a-process. The most promising was about using Windows Performance Toolkit to get a kernel event trace. All necessary information can indeed be pulled from there, but the WPT is a massive overkill for what I need and subsequently has a prohibitive overhead.

My idea was to implement an alternative approach to detecting C/C++ dependency graphs. Usually this is done by passing an option to the compiler (-M, for example). This works fine for compilers and tools which have such an option, but not all of them do, and those who do often implement them differently. So, I implemented an alternative way of doing this on Linux using strace to detect which files are opened. Running gcc (for example) in this way has a 50% overhead (ballpark figure), and I was hoping to figure out a way to do this on windows with a similarish overhead.

The xperf set of tools have two issues which prevents me from using them in this case:

• There is no way to monitor file-I/O events for a single process; I have to use the kernel event trace which traces every single process and thus generates huge amounts of data (15Mb for the time it takes to run gcc, YMMV).
• As a result of having to use the kernel event trace, I have to run as administrator.

I really don't need events at the kernel level; I suppose I could manage just as well if I could just monitor, say, the Win32 API call CreateFile(), and possibly CreateProcess() if I want to catch forked processes.

Any clever ideas?

Answer 1

I used Microsoft's Detours in the past to track memory allocations by intercepting particular API calls. You could use it to track CreateFile and CreateProcess.

Answer 2

Use API hooking. Hooking NtCreateFile and a few other calls in ntdll should be enough. I've had good experience using easyhook as a framework to do the hooking itself - free and open source. Even supports managed hooking (c# etc) if you wanted to do that. It's quite easy to set up.

It's at located at http://easyhook.codeplex.com

Edit: btw detours does not allow 64 bit hooking (unless you buy a license for a nominal price of 10,000USD) EasyHook does not allow native hooks across a WOW64 boundary. It allows managed hooking across WOW64 boundaries though.