使用 C# 代碼中的 DeviceIoControl 始終返回空的 output 緩沖區

Question

我有一個驅動程序，我想從我的 C# 客戶端應用程序中使用它。 這里的問題是我的 output 緩沖區始終為空 (0)。 當我從 C 代碼中使用此驅動程序時 - 一切都像魅力一樣，所以我認為問題出在我的客戶端 C# 代碼中。

外部定義如下：

    [DllImport(kernel, EntryPoint = "DeviceIoControl", SetLastError = true, CharSet = CharSet.Auto)]
    [return: MarshalAs(UnmanagedType.Bool)]
    public static extern bool DeviceIoControl(
        SafeFileHandle hDevice,
        UInt32 dwIoControlCode,
        IntPtr lpInBuffer,
        UInt32 nInBufferSize,
        IntPtr lpOutBuffer,
        UInt32 nOutBufferSize,
        ref UInt32 lpBytesReturned,
        [In] ref NativeOverlapped lpOverlapped);

我將其用作：

    public static T ReadVirtualMemory<T>(SafeFileHandle driverHandle, int offset) where T : unmanaged
    {
        var inBuffer = (object)new T();
        var nInBufferSize = Marshal.SizeOf(typeof(T));

        var outBuffer = (object)new T();
        var nOutBufferSize = Marshal.SizeOf(typeof(T));

        var data = new KERNEL_READ_REQUEST
        {
            Address = (ulong)offset,
            Size = (ulong)nInBufferSize,
            pBuffer = (IntPtr)inBuffer
        };

        IntPtr lpInBuffer = IntPtr.Zero;
        IntPtr lpOutBuffer = IntPtr.Zero;

        nInBufferSize = Marshal.SizeOf(data);
        lpInBuffer = Marshal.AllocHGlobal(nInBufferSize);
        Marshal.StructureToPtr(data, lpInBuffer, true);

        lpOutBuffer = Marshal.AllocHGlobal(nOutBufferSize);
        Marshal.StructureToPtr(outBuffer, lpOutBuffer, true);

        UInt32 lpBytesReturned = 0;
        NativeOverlapped lpOverlapped = new NativeOverlapped();

        Kernel32.DeviceIoControl(
            driverHandle,
            (uint)DriverMethod.ReadMemory,
            lpInBuffer,
            (uint)nInBufferSize,
            lpOutBuffer,
            (uint)nOutBufferSize,
            ref lpBytesReturned,
            ref lpOverlapped);

        outBuffer = (T)Marshal.PtrToStructure(lpOutBuffer, typeof(T));

        return lpBytesReturned == nOutBufferSize ? (T)outBuffer : default;
    }

我不知道為什么，返回的字節數 = 8，雖然它應該是 4。正如我所說的 - 輸出緩沖區是空的。 司機的代碼：

    PKERNEL_READ_REQUEST readRequest = (PKERNEL_READ_REQUEST)pIrp->AssociatedIrp.SystemBuffer;
    PEPROCESS process;

    if (NT_SUCCESS(PsLookupProcessByProcessId(ProcessId, &process)))
    {
        DebugMessage("ReadRequest requested\n");

        KernelReadVirtualMemory(process, readRequest->Address, readRequest->pBuffer, readRequest->Size);

        byteIo = sizeof(PKERNEL_READ_REQUEST);
        status = STATUS_SUCCESS;
    }

和

    NTSTATUS NTAPI MmCopyVirtualMemory
    (
        PEPROCESS SourceProcess,
        PVOID SourceAddress,
        PEPROCESS TargetProcess,
        PVOID TargetAddress,
        SIZE_T BufferSize,
        KPROCESSOR_MODE PreviousMode,
        PSIZE_T ReturnSize
    );

    NTSTATUS KernelReadVirtualMemory(PEPROCESS process, PVOID sourceAddress, PVOID targetAddress, SIZE_T size)
    {
        PSIZE_T bytes;

        return MmCopyVirtualMemory(process, sourceAddress, PsGetCurrentProcess(), targetAddress, size, KernelMode, &bytes);
    }

可能這是關於結構 alignment 的消息，但我不確定（在 C 客戶端應用程序結構中，結構為 18 個字節，在 C# 中為 32 個字節）。

請指教

Answer 1

首先 - 我必須在 x64 中編譯。 第二 - 必須為 pBuffer 分配 memory

下面是一個工作示例

        var nInBufferSize = Marshal.SizeOf(typeof(T));
        var inBuffer = Marshal.AllocHGlobal(nInBufferSize);

        var data = new KERNEL_READ_REQUEST
        {
            Address = offset,
            Size = nInBufferSize,
            pBuffer = inBuffer
        };

        var requestSize = Marshal.SizeOf(data);
        var requestBuffer = Marshal.AllocHGlobal(requestSize);
        Marshal.StructureToPtr(data, requestBuffer, true);

        uint bytesReturned = 0;
        var overlapped = new NativeOverlapped();

        Kernel32.DeviceIoControl(
            driverHandle,
            (uint)DriverMethod.ReadMemory,
            requestBuffer,
            (uint)requestSize,
            requestBuffer,
            (uint)requestSize,
            ref bytesReturned,
            ref overlapped);

        var result = Marshal.PtrToStructure(data.pBuffer, typeof(T));

        return (T?)result ?? default;