Function Catch_NtReadVirtualMemory

RedEdrDll/dllmain.cpp:351–384

    );
pNtReadVirtualMemory Real_NtReadVirtualMemory = NULL;
NTSTATUS NTAPI Catch_NtReadVirtualMemory(
    HANDLE              ProcessHandle,
    PVOID               BaseAddress,
    PVOID               Buffer,
    ULONG               NumberOfBytesToRead,
    PULONG              NumberOfBytesRead
) {
    int64_t time = get_time();
    char buf[DATA_BUFFER_SIZE] = "";

    if (HooksInitialized) { // dont log our own hooking
        if (!skip_self_readprocess || ProcessHandle != (HANDLE)-1) {
            int offset = 0;
            offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "{");
            offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"type\":\"dll\",");
            offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"time\"k:%llu,", time);
            offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"pid\":%lu,", (DWORD)GetCurrentProcessId());
            offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"tid\":%lu,", (DWORD)GetCurrentThreadId());
            offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"func\":\"NtReadVirtualMemory\",");
            offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"handle\":%lld,", (long long)ProcessHandle);
            offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"base_address\":%llu,", BaseAddress);
            offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"buffer\":%llu,", Buffer);
            offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"size\":%lu", NumberOfBytesToRead);
            offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "}");
            SendDllPipe(buf);
        }

        // Currently makes notepad.exe crash on save dialog open on win11.
        // And its a lot of data
        //offset += LogMyStackTrace(&buf[ret], DATA_BUFFER_SIZE - ret);
    }

    return Real_NtReadVirtualMemory(ProcessHandle, BaseAddress, Buffer, NumberOfBytesToRead, NumberOfBytesRead);
}


/******************* NtSetContextThread ************************/