search

nektra / Deviare-InProc

Deviare In Process Instrumentation Engine
http://nektra.com/products/deviare-api-hook-windows/deviare-in-process/
Other
330 stars 84 forks source link

Question about Deviare-InProc #23

Open 99bobster99 opened 5 years ago

99bobster99 commented 5 years ago

Hello Mauro,

Do you know of any Deviare-InProc example code that also writes the "NktProcessMemory" parameters?

I am trying to intercept process calls and then redirect file and registry requests to another drive location (on a network).

Is this possible to do with Deviare-InProc?

mxmauro commented 5 years ago

Hi @99bobster99 ,

Is it possible? YES Is there any sample? NO. All available samples are included with source code.

99bobster99 commented 5 years ago

Hi Mauro,

Thank you for the hope that I can make my test project work. :)

Please let me know if I am on the correct path to success or not. My "theory" outline is below;

-> read the process memory (using "INktProcessMemory.ReadMem") into a byte array, after a successful "CreateFileW" hook.

-> change the intercepted byte array to match the file's new network drive location ( change "c:" to "g:" )

-> write the process memory (using "INktProcessMemory.WriteMem")

Is my basic theory correct? Are there any pitfalls I should keep in mind?