NtReadFile doesn't read

问题

I try to write dll injector with nativeApi. My first question is this good way to do it? And second is: NtReadFile doesn't fail, but also doesn't read. I think it's buffer wrong but i'm not sure? How can i fix this issue?

Now it's look like this:

bool initiationDll(const std::string& dllPath){
if (!isDllExist(dllPath))
{
    printf("Dll doesn't exist!\n");
    return false;
}
else
{
printf("LibraryPath :%s\n", dllPath.c_str());

NTSTATUS status; 
HANDLE lFile;

OBJECT_ATTRIBUTES objAttribs = { 0 }; 
UNICODE_STRING unicodeString;
std::string dllPathWithprefix = "\\??\\" + dllPath;
std::wstring wString = std::wstring(dllPathWithprefix.begin(), dllPathWithprefix.end()); PCWSTR toPcwstr = wString.c_str();
RtlInitUnicodeString(&unicodeString, toPcwstr);
InitializeObjectAttributes(&objAttribs, &unicodeString, OBJ_CASE_INSENSITIVE, NULL, NULL);
objAttribs.Attributes = 0;

const int allocSize = 2048;
LARGE_INTEGER largeInteger;
largeInteger.QuadPart = allocSize;

IO_STATUS_BLOCK ioStatusBlock;

status = NtCreateFile(
    &lFile,
    GENERIC_ALL,
    &objAttribs,
    &ioStatusBlock,
    &largeInteger,
    FILE_ATTRIBUTE_NORMAL, 
    FILE_SHARE_READ, 
    FILE_OPEN,
    FILE_NON_DIRECTORY_FILE, 
    NULL, 
    NULL
);

if (!NT_SUCCESS(status)) {
    printf("CreateFile failed..\n");
    return false;
}
else {
    printf("Library Handle : %p\n", lFile);

    DWORD fileSize = getDllSize(dllPath);

    if (fileSize == 0)
    {
        printf("File size 0.\n");
        return false;
    }
    else
    {
        printf("File size : %d byte.\n", fileSize);

        PVOID FileReadBuffer; 
        FileReadBuffer = new CHAR[fileSize];

        status = NtReadFile(
            lFile,
            NULL,
            NULL, 
            NULL, 
            &ioStatusBlock,
            FileReadBuffer,
            sizeof(FileReadBuffer),
            0, // ByteOffset
            NULL);

        if (!NT_SUCCESS(status))
        {
            printf("Unable to read the dll...  : %d\n", GetLastError());
            return false;
        }
    }
}}

For NtCreateFile :

status -> 0
ioStatusBlock : Status      -> 0
                Pointer     -> 0x00000000
                Information -> 1

I try NtOpenFile and same result.

For NtReadFile :

status -> -1073741811
ioStatusBlock : Status      -> 0
                Pointer     -> 0x00000000
                Information -> 1

Result values right after NtCreateFile function

Result values right after NtReadFile function

回答1:

if (lFile == INVALID_HANDLE_VALUE) - you need check status returned but not lFile and NT never set file handle to INVALID_HANDLE_VALUE - so condition always will be FALSE. OPEN_EXISTING (3) - wrong constant to NtCreateFile - need use FILE_OPEN(1) for example or use NtOpenFile. you open file as asynchronous (no FILE_SYNCHRONOUS_IO_NONALERT or FILE_SYNCHRONOUS_IO_NALERT ) - so faster of all you got STATUS_PENDING (0x103) as result of NtReadFile. so you not enter to if (!NT_SUCCESS(status)) block for STATUS_PENDING but data yet not ready in FileReadBuffer.

and next time post all status and ioStatusBlock values

来源：https://stackoverflow.com/questions/39321182/ntreadfile-doesnt-read

标签

c++

winapi

visual-c++

code-injection