title: Which user-mode functions to hook to monitor/intercept file access?
body: <p>Which user-mode functions in Windows 7 can I hook to monitor/<strong>intercept file access</strong>?</p>
  
  <p>I've tried ntdll.dll's <code>NtOpenFile()</code>, <code>NtCreateFile()</code>, but some of these aren't files - they're also pipes and mutexes. Same goes for kernel32.dll's <code>CreateFile()</code>. Is there a function that is called only to access files/directories. If it helps, I'm trying to only hook explorer.exe to prevent access to firefox.exe. I'm also using EasyHook, if any of you have familiarity with it.</p>
  
  <p>I think I've also read somewhere that, using the parameters from NtOpenFile/NtCreateFile, you can distinguish between file access/pipe access. But that's still a bit hazy. Is there a nice comfortable function to hook?</p>
  
  <p>EDIT: Please keep in mind I do need to <strong>intercept file access</strong> to prevent access to some files. EasyHook is a great solution, since it allows me to perform complicated hooking in a few easy steps in C# managed code.</p>