Function Catch_NtOpenThread

RedEdrDll/dllmain.cpp:887–912

    );
pNtOpenThread Real_NtOpenThread = NULL;
NTSTATUS NTAPI Catch_NtOpenThread(
    OUT PHANDLE             ThreadHandle,
    IN ACCESS_MASK          DesiredAccess,
    IN POBJECT_ATTRIBUTES   ObjectAttributes,
    IN CLIENT_ID*           ClientId
) {
    int64_t time = get_time();
    char buf[DATA_BUFFER_SIZE] = "";
    if (HooksInitialized) { // dont log our own hooking
        int offset = 0;
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "{");
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"type\":\"dll\",");
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"time\":%llu,", time);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"pid\":%lu,", (DWORD)GetCurrentProcessId());
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"tid\":%lu,", (DWORD)GetCurrentThreadId());
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"func\":\"NtOpenThread\",");
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"thread_handle\":%lld,", ThreadHandle);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"access_mask\":%lu,", DesiredAccess);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"client_id_process\":%llu,", ClientId->UniqueProcess);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"client_id_thread\":%llu,", ClientId->UniqueThread);
        offset += LogMyStackTrace(&buf[offset], DATA_BUFFER_SIZE - offset);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "}");
        SendDllPipe(buf);
    }
    return Real_NtOpenThread(ThreadHandle, DesiredAccess, ObjectAttributes, ClientId);
}


/******************* NtCreateSection ************************/