Function Catch_NtCreateThreadEx

RedEdrDll/dllmain.cpp:706–742

    );
pNtCreateThreadEx Real_NtCreateThreadEx = NULL;
NTSTATUS NTAPI Catch_NtCreateThreadEx(
    OUT PHANDLE             ThreadHandle,
    IN ACCESS_MASK          DesiredAccess,
    IN POBJECT_ATTRIBUTES   ObjectAttributes,
    IN HANDLE               ProcessHandle,
    IN PVOID                StartRoutine,
    IN PVOID                Argument,
    IN ULONG                CreateFlags,
    IN ULONG_PTR            ZeroBits,
    IN SIZE_T               StackSize,
    IN SIZE_T               MaximumStackSize,
    IN PVOID                AttributeList
) {
    int64_t time = get_time();
    char buf[DATA_BUFFER_SIZE] = "";

    NTSTATUS ret = Real_NtCreateThreadEx(ThreadHandle, DesiredAccess, ObjectAttributes, ProcessHandle, StartRoutine, Argument, CreateFlags, ZeroBits, StackSize, MaximumStackSize, AttributeList);
    if (HooksInitialized) { // dont log our own hooking
        HANDLE rThreadHandle = (ThreadHandle != NULL) ? *ThreadHandle : NULL;

        int offset = 0;
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "{");
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"type\":\"dll\",");
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"time\":%llu,", time);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"pid\":%lu,", (DWORD)GetCurrentProcessId());
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"tid\":%lu,", (DWORD)GetCurrentThreadId());
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"func\":\"NtCreateThreadEx\",");
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"thread_handle\":%lld,", rThreadHandle);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"handle\":%lld,", (long long)ProcessHandle);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"start_routine\":%llu,", StartRoutine);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"argument\":%llu", Argument);
        //offset += LogMyStackTrace(&buf[offset], DATA_BUFFER_SIZE - offset);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "}");
        SendDllPipe(buf);
    }
    return ret;
}


/******************* NtOpenProcess ************************/