| 88 | }; |
| 89 | |
| 90 | NTSTATUS NTAPI XDriver::ZwReadFile_Hook(HANDLE FileHandle, HANDLE Event, PIO_APC_ROUTINE ApcRoutine, PVOID ApcContext, PIO_STATUS_BLOCK IoStatusBlock, PVOID Buffer, ULONG Length, PLARGE_INTEGER ByteOffset, PULONG Key) |
| 91 | { |
| 92 | |
| 93 | typedef struct BATTLEYE_DATA |
| 94 | { |
| 95 | BYTE ID; |
| 96 | BYTE Data[256]; |
| 97 | }BATTLEYE_DATA, *PBATTLEYE_DATA; |
| 98 | PBATTLEYE_DATA Packet = reinterpret_cast<PBATTLEYE_DATA>(Buffer); |
| 99 | NTSTATUS Status = o_ZwReadFile(FileHandle, Event, ApcRoutine, ApcContext, IoStatusBlock, Buffer, Length, ByteOffset, Key); |
| 100 | if (NT_SUCCESS(Status)) |
| 101 | { |
| 102 | if (Packet->ID == 3) |
| 103 | { |
| 104 | if (!dwProcessId) |
| 105 | { |
| 106 | dwProcessId = *reinterpret_cast<DWORD*>(reinterpret_cast<DWORD_PTR>(Buffer) + 1); |
| 107 | } |
| 108 | } |
| 109 | } |
| 110 | |
| 111 | return Status; |
| 112 | } |
| 113 | |
| 114 | NTSTATUS NTAPI XDriver::ZwWriteFile_Hook(HANDLE FileHandle, HANDLE Event, PIO_APC_ROUTINE ApcRoutine, PVOID ApcContext, PIO_STATUS_BLOCK IoStatusBlock, PVOID Buffer, ULONG Length, PLARGE_INTEGER ByteOffset, PULONG Key) |
| 115 | { |
nothing calls this directly
no outgoing calls
no test coverage detected