AuditQuerySystemPolicy() function 为“安全性 State 更改”抛出 AccessViolationException

Question

I'm working on a program that will compile information about the audit policy of a local system. Here is my code:

    [DllImport("advapi32.dll", SetLastError = true)]
    public static extern bool AuditQuerySystemPolicy(
        Guid pSubCategoryGuids,
        uint PolicyCount,
        out IntPtr ppAuditPolicy
    );

    ...

    void getSubCategories(AuditPolicyCategory category, long guidSize) {
        IntPtr ppAuditSubCategoriesArray = IntPtr.Zero;
        uint pCountReturned = 0;
        Guid catGuid = category.CategoryGuid;
        bool result = AuditEnumerateSubCategories(ref catGuid, false, out ppAuditSubCategoriesArray, out pCountReturned);
        if (!result) {
            throw new Exception($"[AuditPolicyCategory::getSubCategories] {new Win32Exception(Marshal.GetLastWin32Error()).Message}");
        }
        long ptr = (long)ppAuditSubCategoriesArray;
        for (int i = 0; i < pCountReturned; i++) {
            var guid = (Guid)Marshal.PtrToStructure((IntPtr)ptr, typeof(Guid));
            string name = getSubCategoryName(guid);
            Console.WriteLine($"Current subcategory: {name}");
            
            //do something with the result
            ptr += guidSize;
        }
        AuditFree(ppAuditSubCategoriesArray);
    }

The exception is thrown when the below method hits the AuditQuerySystemPolicy() function. It throws an AccessViolationException regardless of the value of catGuid :

    AuditType getPolicyStatus(Guid guid) {
        IntPtr ppAuditPolicy = IntPtr.Zero;
        
        if (!result) {
            throw new Exception($"[AuditPolicyCategory::getPolicyStatus] {new Win32Exception(Marshal.GetLastWin32Error()).Message}");
        }
        if (IntPtr.Zero.Equals(ppAuditPolicy)) {
            throw new Exception($"[AuditPolicyCategory::getPolicyStatus] invalid audit policy returned");
        }
    
        //do something with the result
    }

I've tried running the program in an administrative context, and I've also granted my account the Manage audit and security log User Right Assignment. Not sure where to go with this next.

Thanks in advance!

Answer 1

I needed to change the target platform from Any CPU to x64 to escape the .NET sandbox