I am trying to monitor MoveFile(Ex) and CopyFile(Ex) on a system. I have
found ways to hook into user level processes (Detours). But this only
captures one process, and requires manual injection. I would like to start
monitoring at boot time without manually injecting anything. Currently I am
using a driver that intercepts system services, but I have no idea how to
map Win32 functions to system services. Any insight on this would be greatly
appreciated.