Q:

Hooking ReadFile WinAPI

Im using mhook C++ lib to hook WinAPI. I have a problem..
This is a hooked func:
BOOL WINAPI HookedReadFile(
    _In_         HANDLE hFile,
    _Out_        LPVOID lpBuffer,
    _In_         DWORD nNumberOfBytesToRead,
    _Out_opt_    LPDWORD lpNumberOfBytesRead,
    _Inout_opt_  LPOVERLAPPED lpOverlapped)
{

    if (inWork && hFile == CryptedFileHandle)
    {
        DWORD readedCount = 0;
        DWORD toReadCount = nNumberOfBytesToRead;
        LPBYTE Buf = new BYTE[toReadCount];
        BOOL result = OriginalReadFile(hFile, Buf, toReadCount, &readedCount, NULL);
        if (result && readedCount > 0)
        {
                    // decryption routine will be here
            std::copy(Buf, Buf + readedCount, (LPBYTE)lpBuffer);

    }
    lpNumberOfBytesRead = &readedCount;
    delete[] Buf;
    return result;
} else
    return OriginalReadFile(hFile, lpBuffer, nNumberOfBytesToRead,      lpNumberOfBytesRead, lpOverlapped);
}

This must works simple. If its crypted file app will decrypt bytes on the fly (simple xors).
But it does not works. I think the problem is in std::copy(Buf, Buf + readedCount, (LPBYTE)lpBuffer); becouse program cant read this file normaly. 

A:

Here a major problem:
pNumberOfBytesRead = &readedCount;

Here you make pNumberOfBytesRead point to the local variable readedCount. Besides the problem of trying to "return" a pointer to a local variable (which goes out of scope at the next closing brace), you also have forgotten that arguments, even pointers, are passed by value so you only change your local copy of pNumberOfBytesRead.
What you should do instead is to use the dereference operator * and assign to it as a value
*pNumberOfBytesRead = readedCount;

As for the std::copy call, it looks legit. Maybe whatever problem you have is in some code you don't show us? Have you tried stepping through the code in a debugger?

