hooking into windows accessing files

Question

is it possible to hook into Windows loading or saving files to modify file on the fly (for example to encode/decode it on the fly)? hook into it no matter how file is open (copied, opened with notepad, with word, etc.)

how?

would code need Administrative rights to launch?

Answer 1

You probably will have to write a driver. See if you can get a hold of Filemon's source, there is a lot to learn there.

Answer 2

You could also use something like madCodeHook to intercept file read/writes and to install your dll into every process. I've used this technique to record print jobs for billing purposes.

Answer 3

avoid madCodeHook (not profesdional) use standard api hooking mechanisms (Richter and Microsoft D mainly)

Answer 4

Yes, you need to write an Installable File System driver. The Installable File System Kit from Microsoft contains a couple of sample drivers, including the one used by Filemon. Unfortunately, I do not believe you can access those API's without the IFS Kit.