NtRequestPort - parameter incorrect

296 views Asked by At

I'm try to communicate with \Windows\SbApiPort port .

The problem is that I get an error from NtRequestPort (0xc000000d - status invalid parameter).

The parameters of PORT_MESSAGE are not documented so I don't know where is my problem... I tried to change the length, CallbackId, but the same problem...

Thanks for the help !

Here is the code:

HANDLE hSection=0;
LARGE_INTEGER SecSize;

SecSize.LowPart=0x10000;
SecSize.HighPart=0x0;

if(NtCreateSection(&hSection, SECTION_ALL_ACCESS, NULL, &SecSize, PAGE_READWRITE,SEC_COMMIT ,NULL))
{
    printf("couldn't create a section");
}

HANDLE hPort;
PORT_VIEW sectionInfo;
REMOTE_PORT_VIEW mapInfo;
byte ConnectDataBuffer[0x100];
DWORD Size = sizeof(ConnectDataBuffer);
UNICODE_STRING uStr;
WCHAR * uString=L"\\Windows\\SbApiPort";
DWORD maxSize;
SECURITY_QUALITY_OF_SERVICE qos;

for (int i=0 ; i < 0x100 ; i++)
{
    ConnectDataBuffer[i]=0xcc;
}

memset(&sectionInfo, 0, sizeof(sectionInfo));
memset(&mapInfo, 0, sizeof(mapInfo));
memset(&mapInfo, 0, sizeof(mapInfo));

memset(&qos, 0, sizeof(qos));

qos.Length = sizeof(SECURITY_QUALITY_OF_SERVICE);
qos.ImpersonationLevel = SecurityImpersonation;
qos.ContextTrackingMode = SECURITY_DYNAMIC_TRACKING;
qos.EffectiveOnly = TRUE;

sectionInfo.Length = sizeof(LPC_SECTION_OWNER_MEMORY);
sectionInfo.SectionHandle = hSection;
sectionInfo.SectionOffset = 0;
sectionInfo.ViewSize = 0x10000;
sectionInfo.ViewBase = NULL;
sectionInfo.ViewRemoteBase  = NULL;


mapInfo.Length = sizeof(LPC_SECTION_MEMORY);
mapInfo.ViewSize = 0;
mapInfo.ViewBase = NULL;

uStr.Length = wcslen(uString)*2;
uStr.MaximumLength = wcslen(uString)*2+2;
uStr.Buffer =uString;

NTSTATUS res = NtConnectPort(&hPort,&uStr,&qos,&sectionInfo,&mapInfo,&maxSize,(DWORD*)&ConnectDataBuffer,&Size);
if (res)
{
    printf("Could not connect to LPC port.\n -%x", res);
    return 1;
}

PORT_MESSAGE PortMessage;
ZeroMemory(&PortMessage,sizeof(PORT_MESSAGE));

PortMessage.u1.Length = 0x20;
PortMessage.u2.s2.DataInfoOffset = 15;
PortMessage.u2.ZeroInit = 0x20;
PortMessage.MessageId = LPC_REQUEST;
PortMessage.ClientViewSize = 0x20;
PortMessage.ClientId.UniqueProcess = GetCurrentProcess();
PortMessage.ClientId.UniqueThread = GetCurrentThread();
PortMessage.CallbackId = 0;

res = NtRequestPort(hPort, &PortMessage);
if (res)
{
    printf("Could not request LPC port.\n -%x", res);
    return 1;
}
printf("End\n", res);
0

There are 0 answers