Intercepting file access

Question

I have a program (a game, really), which uses a .wad file to store its resources. Is it possible to somehow intercept access to this file, and emulate it?

For instance, I want to dynamically replace some sprites. Instead of creating a new file, is it possible to make this game think it is accessing the .wad, but actually we process its requests?

Answer 1

Under Windows the File System Filter Driver provides a low level I/O hook that a program can register to be passed the I/O requests to the file system.

Filter drivers can also alter the data passed via filters or deny filesystem requests.

Implementation, maintenance and support of your such kernel-mode code is non-trivial.

Anyway you could also take a look at:

• Winpooch: an antivirus has to intercept file accesses so an open source antivirus can be a good starting point to study filters.
• EasyHook: for Windows API hooking