Question about Deviare-InProc

[99bobster99]

Hello Mauro,

Do you know of any Deviare-InProc example code that also writes the "NktProcessMemory" parameters?

I am trying to intercept process calls and then redirect file and registry requests to another drive location (on a network).

Is this possible to do with Deviare-InProc?

[mxmauro]

Hi @99bobster99 ,

Is it possible? YES
Is there any sample? NO. All available samples are included with source code.

[99bobster99]

Hi Mauro,

Thank you for the hope that I can make my test project work. :)

Please let me know if I am on the correct path to success or not. My "theory" outline is below;

-> read the process memory (using "INktProcessMemory.ReadMem") into a byte array, after a successful "CreateFileW" hook.

-> change the intercepted byte array to match the file's new network drive location ( change "c:" to "g:" )

-> write the process memory (using "INktProcessMemory.WriteMem")

Is my basic theory correct? Are there any pitfalls I should keep in mind?