我尝试调用函数NtConnectPort-创建一个部分,然后将该部分转发到NtConnectPort。

我从函数NtConnectPort收到运行错误。返回值为c000000d-参数不正确。

我不明白为什么。有任何想法吗?

代码:

HANDLE hSection=0;
LARGE_INTEGER SecSize;

SecSize.LowPart=0x10000;
SecSize.HighPart=0x0;

if(NtCreateSection(&hSection, SECTION_ALL_ACCESS, NULL, &SecSize, PAGE_READWRITE,SEC_COMMIT ,NULL))
{
    printf("couldn't create a section");
}

HANDLE hPort;
LPC_SECTION_OWNER_MEMORY sectionInfo;
LPC_SECTION_MEMORY mapInfo;
byte ConnectDataBuffer[0x100];
DWORD Size = sizeof(ConnectDataBuffer);
UNICODE_STRING uStr;
WCHAR * uString=L"\\SmApiPort";
DWORD maxSize;
SECURITY_QUALITY_OF_SERVICE qos;

for (int i=0 ; i < 0x100 ; i++)
{
    ConnectDataBuffer[i]=0x0;
}

memset(&sectionInfo, 0, sizeof(sectionInfo));
memset(&mapInfo, 0, sizeof(mapInfo));

sectionInfo.Length = 24;
sectionInfo.SectionHandle =hSection;
sectionInfo.ViewSize = 0x10000;

mapInfo.Length = 0x0C;

uStr.Length = wcslen(uString)*2;
uStr.MaximumLength = wcslen(uString)*2+2;
uStr.Buffer =uString;


NTSTATUS res = NtConnectPort(&hPort,&uStr,&qos,(LPC_SECTION_OWNER_MEMORY*)&sectionInfo,(LPC_SECTION_MEMORY*)&mapInfo,&maxSize,(DWORD*)ConnectDataBuffer,&Size);
if (res)
{
    printf("Could not connect to LPC port.\n -%x", res);
    return 1;
}



typedef struct _LPC_SECTION_OWNER_MEMORY {
ULONG                   Length;
HANDLE                  SectionHandle;
ULONG                   OffsetInSection;
ULONG                   ViewSize;
PVOID                   ViewBase;
PVOID                   OtherSideViewBase;
} LPC_SECTION_OWNER_MEMORY, *PLPC_SECTION_OWNER_MEMORY;

typedef struct _LPC_SECTION_MEMORY {
ULONG                   Length;
ULONG                   ViewSize;
PVOID                   ViewBase;
} LPC_SECTION_MEMORY, *PLPC_SECTION_MEMORY;


NTSYSAPI NTSTATUS NTAPI NtConnectPort(
OUT PHANDLE PortHandle,
IN  PUNICODE_STRING PortName,
IN  PSECURITY_QUALITY_OF_SERVICE SecurityQos,
//IN  OUT PPORT_VIEW ClientView OPTIONAL,
IN OUT PLPC_SECTION_OWNER_MEMORY ClientSharedMemory,
OUT PLPC_SECTION_MEMORY ServerSharedMemory,
//OUT PREMOTE_PORT_VIEW ServerView OPTIONAL,
OUT PULONG MaxMessageLength OPTIONAL,
IN  OUT PVOID ConnectionInformation OPTIONAL,
IN  OUT PULONG ConnectionInformationLength OPTIONAL
);


NTSYSAPI NTSTATUS NTAPI ZwConnectPort(
OUT PHANDLE PortHandle,
IN  PUNICODE_STRING PortName,
IN  PSECURITY_QUALITY_OF_SERVICE SecurityQos,
IN OUT PLPC_SECTION_OWNER_MEMORY ClientSharedMemory,
OUT PLPC_SECTION_MEMORY ServerSharedMemory,
//IN OUT int int1,
//IN  OUT PPORT_VIEW ClientView OPTIONAL,
//OUT PREMOTE_PORT_VIEW ServerView OPTIONAL,
OUT PULONG MaxMessageLength OPTIONAL,
IN  OUT PVOID ConnectionInformation OPTIONAL,
IN  OUT PULONG ConnectionInformationLength OPTIONAL
);

最佳答案

您没有初始化qos变量(http://msdn.microsoft.com/en-us/library/windows/desktop/aa379574(v=vs.85).aspx


  SecurityQos-指向指定级别的结构
          可用于端口侦听器的模拟。

10-04 20:21