Function Catch_NtCreateTimer2

RedEdrDll/dllmain.cpp:1111–1136

    );
pNtCreateTimer2 Real_NtCreateTimer2 = NULL;
NTSTATUS NTAPI Catch_NtCreateTimer2(
    OUT PHANDLE             TimerHandle,
    IN PVOID                Reserved1 OPTIONAL,
    IN PVOID                Reserved2 OPTIONAL,
    IN ULONG                Attributes,
    IN ACCESS_MASK          DesiredAccess
) {
    int64_t time = get_time();
    char buf[DATA_BUFFER_SIZE] = "";

    if (HooksInitialized) { // dont log our own hooking
        int offset = 0;
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "{");
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"type\":\"dll\",");
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"time\":%llu,", time);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"pid\":%lu,", (DWORD)GetCurrentProcessId());
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"tid\":%lu,", (DWORD)GetCurrentThreadId());
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"func\":\"NtCreateTimer2\",");
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"attributes\":%lu,", Attributes);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"desired_access\":%lu", DesiredAccess);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "}");

        SendDllPipe(buf);
    }
    return Real_NtCreateTimer2(TimerHandle, Reserved1, Reserved2, Attributes, DesiredAccess);
}


/******************* CreateRemoteThread ************************/