Read Inside Windows 2000 by David Solomon and Mark Russinovich (MS Press). For CreateFile (there is no OpenFile), the entry point in kernel32.dll converts the file name into an absolute path suitable for the object manager, converts the other parameters as appropriate, then calls NtCreateFile in ntdll.dll. This is a fairly simple routine which executes software interrupt 0x2e (Windows 2000) or uses the SYSENTER instruction (Windows XP) to change to kernel mode and execute the kernel mode NtCreateFile routine. From there, the object manager (an Executive component) is used to locate the device object corresponding to the file system, whose Parse function is called to process the rest of the path. You probably want to write a file system filter driver: a driver that sits above the file system and gets to see and manipulate I/O Request Packets destined for the file system. I think you need the Installable File System kit[^] for developing file system filter drivers.