Method ZwWriteFile_Hook

NoEye/ServiceConnection.cpp:114–140

		}

		NTSTATUS NTAPI XDriver::ZwWriteFile_Hook(HANDLE FileHandle, HANDLE Event, PIO_APC_ROUTINE  ApcRoutine, PVOID ApcContext, PIO_STATUS_BLOCK IoStatusBlock, PVOID Buffer, ULONG Length, PLARGE_INTEGER   ByteOffset, PULONG Key)
		{

			typedef struct BATTLEYE_DATA
			{
				BYTE ID;
				BYTE Data[256];
			}BATTLEYE_DATA, *PBATTLEYE_DATA;
			PBATTLEYE_DATA Packet = reinterpret_cast<PBATTLEYE_DATA>(Buffer);
			for (auto Handle : fIOs)
			{
				if (Handle == FileHandle &&
					Length == 4)
				{
					*reinterpret_cast<DWORD*>(Buffer) = GetCurrentProcessId();
				}
			}
			if (Length && Buffer && Packet->ID == 2)
			{
				if (*reinterpret_cast<DWORD*>(reinterpret_cast<DWORD_PTR>(Buffer) + 1) == 0)
				{
					*reinterpret_cast<DWORD*>(reinterpret_cast<DWORD_PTR>(Buffer) + 1) = dwProcessId;
				}
			}

			return o_ZwWriteFile(FileHandle, Event, ApcRoutine, ApcContext, IoStatusBlock, Buffer, Length, ByteOffset, Key);
		}
	}
}