Skip to content

Hook Read calls #4

@ShakedGold

Description

@ShakedGold

I tried hooking a Read call which does work:

//export detourReadFile
func DetourReadFile(hFile C.HANDLE, lpBuffer C.LPVOID, nNumberOfBytesToRead C.DWORD, lpNumberOfBytesRead C.LPDWORD, lpOverlapped C.LPOVERLAPPED) C.BOOL {
	result, _, lastErr := syscall.SyscallN(
		uintptr(unsafe.Pointer(readTrampoline)),
		uintptr(unsafe.Pointer(hFile)),
		uintptr(unsafe.Pointer(lpBuffer)),
		uintptr(C.DWORD(uint(nNumberOfBytesToRead))),
		uintptr(unsafe.Pointer(lpNumberOfBytesRead)),
		uintptr(unsafe.Pointer(lpOverlapped)),
	)
	if result == 0 {
		fmt.Println("Error reading file: ", lastErr)
		return C.BOOL(0)
	}
        return C.BOOL(result)
}

The hooking most of the time works but sometimes I get an error:
Error reading file: The pipe has been ended

Also the program freezes and refuses to continue (If I remove the read hooking, It is not freezing anymore), Am I doing something wrong here?

I don't know if this the error related to the freezing.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions