I do not know your code, but what I suspect:
1. CloseHandle is called SIGNIFICANTLY more frequently that CreateFile
function. CloseHandle may be call after OpenProcess, DuplicateHandle,
CreateFileMapping, CreateFileForMapping and ...
It is why "appears a lot of trace string in my"
2. Also I suspect that DetourFunctionWith *** oline substitute the
function addresses only when it was called. However notepad in some
situation (for example, when you open file dialog) loads new DLLs and I
think it is necessary to update substitutions in those mew loaded DLLs.
If you run NOTEPAD under standard MSDEV de *** you may see when
notepad loads or unloads DLLs.
My opinion is instead of using DetourFunctionWith *** oline implement
your de *** application. Put break points at CreateFile, CloseHandle
and so on and hook all these functions. It is simple because
kernel32.dll is not loaded/unloaded dynamically.
I am doing hooking in this way in my product at http://www.yqcomputer.com/
Other example of hooking is at http://www.yqcomputer.com/