Function Catch_NtWriteVirtualMemory

RedEdrDll/dllmain.cpp:309–337

    );
t_NtWriteVirtualMemory Real_NtWriteVirtualMemory = NULL;
NTSTATUS NTAPI Catch_NtWriteVirtualMemory(
    HANDLE              ProcessHandle,
    PVOID               BaseAddress,
    PVOID               Buffer,
    ULONG               NumberOfBytesToWrite,
    PULONG              NumberOfBytesWritten
) {
    int64_t time = get_time();
    char buf[DATA_BUFFER_SIZE] = "";

    if (HooksInitialized) { // dont log our own hooking
        int offset = 0;
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "{");
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"type\":\"dll\",");
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"time\":%llu,", time);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"pid\":%lu,", (DWORD)GetCurrentProcessId());
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"tid\":%lu,", (DWORD)GetCurrentThreadId());
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"func\":\"NtWriteVirtualMemory\",");
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"handle\":%lld,", (long long)ProcessHandle);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"base_address\":%llu,", BaseAddress);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"buffer\":%llu,", Buffer);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "\"size\":%lu,", NumberOfBytesToWrite);
        offset += LogMyStackTrace(&buf[offset], DATA_BUFFER_SIZE - offset);
        offset += sprintf_s(buf + offset, DATA_BUFFER_SIZE - offset, "}");
        
        SendDllPipe(buf);
    }
    return Real_NtWriteVirtualMemory(ProcessHandle, BaseAddress, Buffer, NumberOfBytesToWrite, NumberOfBytesWritten);
}


/******************* ReadVirtualMemory ************************/