Function Catch_NtQueueApcThreadEx

RedEdrDll/dllmain.cpp:558–589

    );
pNtQueueApcThreadEx Real_NtQueueApcThreadEx = NULL;
NTSTATUS NTAPI Catch_NtQueueApcThreadEx(
    IN HANDLE               ThreadHandle,
    IN HANDLE               ApcThreadHandle,
    IN PVOID                ApcRoutine,
    IN PVOID                ApcArgument1,
    IN PVOID                ApcArgument2,
    IN PVOID                ApcArgument3
) {
    int64_t time = get_time();
    char buf[DATA_BUFFER_SIZE] = "";

    if (HooksInitialized) { // dont log our own hooking
        int offset = 0;
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "{");
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"type\":\"dll\",");
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"time\":%llu,", time);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"pid\":%lu,", (DWORD)GetCurrentProcessId());
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"tid\":%lu,", (DWORD)GetCurrentThreadId());
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"func\":\"NtQueueApcThreadEx\",");
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"thread_handle\":%lld,", ThreadHandle);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"apc_thread\":%llu,", ApcThreadHandle);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"apc_routine\":%llu,", ApcRoutine);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"arg1\":%llu,", ApcArgument1);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"arg2\":%llu,", ApcArgument2);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"arg3\":%llu,", ApcArgument3);
        offset += LogMyStackTrace(&buf[offset], DATA_BUFFER_SIZE - offset);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "}");
        
        SendDllPipe(buf);
    }
    return Real_NtQueueApcThreadEx(ThreadHandle, ApcThreadHandle, ApcRoutine, ApcArgument1, ApcArgument2, ApcArgument3);
}


/******************* NtCreateProcess ************************/