Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

FileRead in tutorial can intercept the event, but not block it #380

Open
giesalabs opened this issue Jul 9, 2021 · 2 comments
Open

FileRead in tutorial can intercept the event, but not block it #380

giesalabs opened this issue Jul 9, 2021 · 2 comments

Comments

@giesalabs
Copy link

giesalabs commented Jul 9, 2021

i'm playing with EasyHook tutorial and kernel32 FileRead
the tutorial can intercept the event and log it, but the hook can't block it by removing out the original function
how is possible?

somthing like:

bool ReadFile_Hook( IntPtr hFile,IntPtr lpBuffer, uint nNumberOfBytesToRead,  out uint lpNumberOfBytesRead, IntPtr lpOverlapped)
        {
            bool result = false;

            // Retrieve filename from the file handle
            StringBuilder filename = new StringBuilder(255);
            GetFinalPathNameByHandle(hFile, filename, 255, 0);

            // don't call the original function
            //result = ReadFile(hFile, lpBuffer, nNumberOfBytesToRead, out lpNumberOfBytesRead, lpOverlapped);

            return result;
        }
@zaee-k
Copy link

zaee-k commented Jan 11, 2022

I know its old but, if you want to block the function, just return a access denied code, which will be presented to the ReadFile caller function. That function will be informed that ReadFile didn't succeeded.

@giesalabs
Copy link
Author

I know its old but, if you want to block the function, just return a access denied code, which will be presented to the ReadFile caller function. That function will be informed that ReadFile didn't succeeded.

What is the access denied code?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants