Search code examples
c++kernel32detours

C++ Reading values of LPCVOID pointer


I have a hook on kernel32.dll's Writefile command. The hook is being triggered, however, I am not able to read the buffer contents.

Goal: Msgbox shows the contents of the buffer being sent to the com port.

Issue: The msgbox is printing a seemingly-random series of numbers, which I am assuming is the memory address, instead of the actual contents of lpBuffer.

C++ code:

void hookedFunc(HANDLE hfile, LPCVOID * lpBuffer, DWORD nNumberBytesToWrite, LPWORD lpNumberofBytesWritten, LPOVERLAPPED lpOverlapped) {

    char *pString = reinterpret_cast<char *>(lpBuffer);

    //Msgbox - arg 1//////////////////////////////////////////////////////////////////////////////
    WCHAR szTest[45];
    swprintf_s(szTest, 45, L"%d|\n", pString);
    MessageBox(NULL, szTest, L"BUFFER CONTENTS", MB_OK);
    swprintf_s(szTest, 45, L"%d", nNumberBytesToWrite);
    MessageBox(NULL, szTest, L"TEST", MB_OK);

}

Solution

  • LPCVOID is a pointer (to a constant), lpBuffer is a pointer to that pointer. I imagine

    const char* pString = reinterpret_cast<const char *>(*lpBuffer);
    

    is what you want.