我正在嘗試使用 NTCreateFile 從磁盤讀取 ntdl.dll，但它似乎沒有正確讀取檔案。本機呼叫不回傳有效句柄。更熟悉這個本機呼叫的人能否指出這段代碼有什么問題？謝謝！
FORCEINLINE VOID RtlInitUnicodeString(
_Out_ PUNICODE_STRING DestinationString,
_In_opt_ PWSTR SourceString
)
{
if (SourceString)
DestinationString->MaximumLength = (DestinationString->Length = (USHORT)(wcslen(SourceString) * sizeof(WCHAR))) sizeof(WCHAR);
else
DestinationString->MaximumLength = DestinationString->Length = 0;
DestinationString->Buffer = SourceString;
}
#define OBJ_CASE_INSENSITIVE 0x00000040
#define FILE_OPEN 0x00000001
#define FILE_DIRECTORY_FILE 0x00000001
#define InitializeObjectAttributes(p, n, a, r, s) { \
(p)->Length = sizeof(OBJECT_ATTRIBUTES); \
(p)->RootDirectory = r; \
(p)->Attributes = a; \
(p)->ObjectName = n; \
(p)->SecurityDescriptor = s; \
(p)->SecurityQualityOfService = NULL; \
}
HANDLE file = NULL;
OBJECT_ATTRIBUTES oa;
UNICODE_STRING f;
UNICODE_STRING fp;
IO_STATUS_BLOCK IoStatusBlock;
WCHAR ntdl[100] = L"\\??\\\\C:\\windows\\system32\\ntdll.dll";
RtlInitUnicodeString(&f, ntdl);
RtlInitUnicodeString(&fp, filepath);
InitializeObjectAttributes(&oa, &f, OBJ_CASE_INSENSITIVE, NULL, NULL);
NtCreateFile(&file, FILE_GENERIC_READ, &oa, &IoStatusBlock, 0, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ, FILE_OPEN, FILE_DIRECTORY_FILE, NULL, 0);
uj5u.com熱心網友回復：
- 路徑必須是
L"\\??\\C:\\windows\\system32\\ntdll.dll" FILE_NON_DIRECTORY_FILE，不是FILE_DIRECTORY_FILE。
轉載請註明出處，本文鏈接：https://www.uj5u.com/caozuo/453670.html
上一篇：在CMD中更改Lua命令
下一篇：Linux之export命令