ring3 hook ntdll!NtCreateSection，为啥获取的ObjectAttributes经常无效

2012-12-15

ring3 hook ntdll!NtCreateSection，为什么获取的ObjectAttributes经常无效NTSTATUS __stdcall Fake_NtCrea

ring3 hook ntdll!NtCreateSection，为什么获取的ObjectAttributes经常无效


NTSTATUS __stdcall Fake_NtCreateSection(
                    OUT PHANDLE SectionHandle,
                    IN ULONG DesiredAccess,
                    IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
                    IN PLARGE_INTEGER MaximumSize OPTIONAL,
                    IN ULONG PageAttributes,
                    IN ULONG SectionAttributes,
                    IN HANDLE FileHandle OPTIONAL)
{

  NTSTATUS status;

  status =  NtCreateSection(SectionHandle,DesiredAccess,ObjectAttributes,MaximumSize,PageAttributes,SectionAttributes,FileHandle);
  if (STATUS_SUCCESS != status)
  {
    return status;
  }
  if (SectionHandle == NULL)
  {
    return STATUS_ACCESS_VIOLATION;
  }
  WCHAR szFilePath[MAX_NAME] = {0};
  GetPath(ObjectAttributes,szFilePath);
  DbgPrint("%s: [%s] Enter! %S \n",__MYNAME__,__FUNCTION__,szFilePath);
  return status;
}

调用GetPath的时候，发现ObjectAttributes经常无效，也就是一堆???，那么就无法取得section的名字了,如何解决啊
BOOL GetPath(IN POBJECT_ATTRIBUTES ObjectAttributes,OUT WCHAR* strPath)
{
  //ObjectAttributes结构体经常无效???
  if (NULL == ObjectAttributes->RootDirectory && NULL == ObjectAttributes->ObjectName)
  {
    return FALSE;
  }

  if (NULL != ObjectAttributes->RootDirectory)
  {
     if (STATUS_SUCCESS != GetFullPathByHandle(ObjectAttributes->RootDirectory, strPath))
     {
       return FALSE;
     }
  }
  if (NULL != ObjectAttributes && NULL != ObjectAttributes->ObjectName && ObjectAttributes->ObjectName->Length > 0)
  {
    lstrcatW(strPath,L"\");
    lstrcatW(strPath,ObjectAttributes->ObjectName->Buffer);
  }
  return TRUE;
}

NTSTATUS GetFullPathByHandle(IN HANDLE ObjectHandle,OUT WCHAR* strFullPath)
{

  NTSTATUS status;
  BOOL bRet = FALSE;
  POBJECT_NAME_INFORMATION pNameInfo = NULL;

  while (true)
  {
    ULONG uResultLength = 0;
    pNameInfo = (POBJECT_NAME_INFORMATION)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 0x200);

    status = NtQueryObject(ObjectHandle, ObjectNameInformation, pNameInfo, 0x200, &uResultLength);
    if (STATUS_INFO_LENGTH_MISMATCH == status ||
      STATUS_BUFFER_OVERFLOW == status ||
      STATUS_BUFFER_TOO_SMALL == status)
    {
      pNameInfo = (POBJECT_NAME_INFORMATION)HeapReAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, pNameInfo, 0x100);
      continue;
    }
    else if (STATUS_SUCCESS == status)
    {
      lstrcpyW(strFullPath,pNameInfo->Name.Buffer);
      break;
    }
    else
    {
      break;
    }

  }

  if (NULL != pNameInfo )
  {
    HeapFree(GetProcessHeap(),0,pNameInfo);
    pNameInfo = NULL;
  }
  return status;
}

[最优解释]
没名字你怎么取
[其他解释]
木有名字啊。。。亲~
[其他解释]
本来就经常没名字
[其他解释]

引用:

本来就经常没名字

ring3下如何取路径呢，ring0的那些ob*都不能用啊~

热点排行

VC/MFC

ring3 hook ntdll!NtCreateSection，为啥获取的ObjectAttributes经常无效