如何将字符串转换为UINT_PTR（在内核中写入字符串）？ [英] How do I cast a string to a UINT_PTR (writing strings in kernel)?

问题描述

我一直试图在内核内存中编写字符串一段时间了。我已经能够阅读字符串了，但是我写它们没有运气。我可以写一些常规的东西，比如DWORD。我一直坚持将字符串转换为UINT_PTR。任何帮助表示赞赏，这是我读取字符串的代码：

I have been attempting to write strings in Kernel Memory for some time now. I have been able to read strings, however I have no luck with writing them. I can write regular things such as a DWORD. I keep getting stuck on casting a string to a UINT_PTR. Any help is appreciated and here is my code for reading strings:

std::string ReadString(UINT_PTR ProcessId, UINT_PTR ReadAddress, SIZE_T Size) {
    if (hDriver == INVALID_HANDLE_VALUE) {
        return {};
    }

    DWORD64 Bytes;
    KERNEL_READ_REQUEST ReadRequest{};

    std::vector<char> buffer(Size, char{ 0 });

    ReadRequest.ProcessId = ProcessId;
    ReadRequest.Address = ReadAddress;
    ReadRequest.Size = buffer.size();
    ReadRequest.Output = static_cast<void*>(&buffer[0]);

    // send code to our driver with the arguments
    if (DeviceIoControl(hDriver, IO_READ_REQUEST, &ReadRequest, sizeof(ReadRequest), &ReadRequest, sizeof(ReadRequest), 0, 0)) {
        return std::string(buffer.data());
    }
    else {
        return {};
    }
}

我尝试了什么： < br $> b $ b

What I have tried:

std::vector<char> buffer(Size, char{ 0 });

我也试过：

I have also tried:

std::string WriteString(UINT_PTR ProcessId, UINT_PTR WriteAddress, UINT_PTR WriteValue, SIZE_T Size) {
    if (hDriver == INVALID_HANDLE_VALUE) {
        return {};
    }

    DWORD64 Bytes;
    KERNEL_WRITE_REQUEST WriteRequest{};

    std::vector<char> buffer(Size, char{ 0 });

    WriteRequest.ProcessId = ProcessId;
    WriteRequest.Address = WriteAddress;
    WriteRequest.Size = buffer.size();
    WriteRequest.Value = WriteValue;

    // send code to our driver with the arguments
    if (DeviceIoControl(hDriver, IO_WRITE_REQUEST, &WriteRequest, sizeof(WriteRequest), 0, 0, 0, 0)) {
        return {};
    }
    else {
        return {};
    }
}

推荐答案

CAST一个字符串？你不能。成为一个有效的指针，这将是一个令人讨厌的字符串。



你必须将字符串PARSE为值。



但是，人们不得不想知道为什么你将内核中的句柄值作为字符串而不是实际值传递给内核/来自内核。

CAST a string? You can't. To be a valid pointer that would be one nasty looking string.

You have to PARSE the string into a value.

But then, one has to wonder why you're passing handle values around in/to/from the kernel as strings instead of the actual values.

你滥用了API。阅读 Microsoft的示例代码和文档。



我无法动态查找有关您的结构的详细信息，因此请仔细搜索并阅读。我最好的猜测是Address是指向数据的指针（你的字符串），Value是一些类型信息，Output是读取数据的数量。



我的真实建议是：阅读文档!!!

You are misusing the API. Read the example code from Microsoft and the documentation.

I cant find details about your struct on the fly, so search and read it carefully. My best guess is that Address is the pointer to the data (your string) and Value is some type information and the Output is the amount of read data.

My real advice is: Read the documentation!!!

这篇关于如何将字符串转换为UINT_PTR（在内核中写入字符串）？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！