Question about Deviare-InProc about deviare-inproc

[mxmauro]

Hi @99bobster99 ,

Is it possible? YES
Is there any sample? NO. All available samples are included with source code.

[99bobster99]

Hi Mauro,

Thank you for the hope that I can make my test project work. :)

Please let me know if I am on the correct path to success or not. My "theory" outline is below;

-> read the process memory (using "INktProcessMemory.ReadMem") into a byte array, after a successful "CreateFileW" hook.

-> change the intercepted byte array to match the file's new network drive location ( change "c:" to "g:" )

-> write the process memory (using "INktProcessMemory.WriteMem")

Is my basic theory correct? Are there any pitfalls I should keep in mind?