Hard. An advanced project, not for someone getting started.
Were I to want to log events to a file, I would probably restrict this to events which cause a message to be either displayed or put in one of the internal logs. This could be semi-automated, other stuff would be harder, and would need customized for each specific case.
Have a coprocess running that does all of the file manipulation. This coprocess would need to have a window, presumably invisible, used as a target for custom Windows messages (WM_USER and above).
I would then search
DF for the string associated with each message I wanted to log. I would replace the call that displays the message with a small 'hook' of custom code. That code first calls
SendMessage with parameters: hardcoded target window handle, WM_USER, hardcoded pointer to the format string, pointer to the actual string being printed (graqbbed from the stack). Then it jumps to the real display routine.
The coprocess would need to quickly grab anything it needs out of
DF and hand that off to a worker thread, because SendMessage is a blocking call, so
DF is paused during this action.
Despite the synchronization issues, I think using a separate process would be less complicated than trying to mess with CreateFile and friends in raw machine code, even lower level than assembly language.