Function Catch_NtCreateProcessEx

RedEdrDll/dllmain.cpp:979–1013

    );
pNtCreateProcessEx Real_NtCreateProcessEx = NULL;
NTSTATUS NTAPI Catch_NtCreateProcessEx(
    OUT PHANDLE             ProcessHandle,
    IN ACCESS_MASK          DesiredAccess,
    IN POBJECT_ATTRIBUTES   ObjectAttributes,
    IN HANDLE               ParentProcess,
    IN ULONG                Flags,
    IN HANDLE               SectionHandle,
    IN HANDLE               DebugPort,
    IN HANDLE               ExceptionPort,
    IN BOOLEAN              InJob
) {
    int64_t time = get_time();
    char buf[DATA_BUFFER_SIZE] = "";

    if (HooksInitialized) { // dont log our own hooking
        int offset = 0;
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "{");
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"type\":\"dll\",");
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"time\":%llu,", time);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"pid\":%lu,", (DWORD)GetCurrentProcessId());
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"tid\":%lu,", (DWORD)GetCurrentThreadId());
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"func\":\"NtCreateProcessEx\",");
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"handle\":%lld,", (long long) ProcessHandle);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"parent_process\":%llu,", (unsigned long long) ParentProcess);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"flags\":%lu,", Flags);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"section_handle\":%llu,", (unsigned long long) SectionHandle);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"debug_port\":%llu,", (unsigned long long) DebugPort);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"exception_port\":%llu,", (unsigned long long) ExceptionPort);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"in_job\":%d,", InJob);
        offset += LogMyStackTrace(&buf[offset], DATA_BUFFER_SIZE - offset);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "}");
        SendDllPipe(buf);
    }
    return Real_NtCreateProcessEx(ProcessHandle, DesiredAccess, ObjectAttributes, ParentProcess, Flags, SectionHandle, DebugPort, ExceptionPort, InJob);
}


/******************* NtCreateEvent ************************/