ConvertLUnicodeStringToNullTerminatedString

ConvertLUnicodeStringToNullTerminatedString

//----- (00000001800B5360) ----------------------------------------------------
__int64 __fastcall `anonymous namespace'::ConvertLUnicodeStringToNullTerminatedString(unsigned __int64 *a1, void **a2)
{
  void **v2; // rsi@1
  unsigned __int64 v3; // rdi@1
  unsigned __int64 *v4; // rbx@1
  const void *v5; // rdx@1
  __int64 v6; // rax@3
  const void *v7; // rdx@3
  signed int v8; // ebx@4
  const void *v9; // rdx@5
  size_t v10; // rdi@5
  char *v11; // rbx@5
  const void *v12; // rdx@5
  const char *v14; // [sp+20h] [bp-40h]@4
  const char *v15; // [sp+28h] [bp-38h]@4
  int v16; // [sp+30h] [bp-30h]@4
  const char *v17; // [sp+38h] [bp-28h]@4
  int v18; // [sp+40h] [bp-20h]@4
  void *Dst; // [sp+48h] [bp-18h]@3

  v2 = a2;
  v3 = *a1 >> 1;
  v4 = a1;
  v5 = (const void *)(v3 + 1);
  if ( v3 + 1 < v3 || (unsigned __int64)v5 < 1 )
  {
    v8 = -2147024362;
    v18 = -2147024362;
    Windows::ErrorHandling::COM::CBaseFrame<Windows::ErrorHandling::COM::CVoidRaiseFrame>::ReportErrorPropagation(&v18);
  }
  else
  {
    Dst = 0i64;
    LODWORD(v6) = Windows::AutoNullTerminatedString<Windows::COM::CLPWSTRTraits,Windows::Auto<unsigned short *>>::ResizeBufferNoPreserve(
                    (Windows::COM **)&Dst,
                    v5);
    if ( v6 )
    {
      v9 = (const void *)v4[2];
      v10 = 2 * v3;
      v11 = (char *)Dst;
      memcpy_0(Dst, v9, v10);
      *(_WORD *)&v11[v10] = 0;
      Dst = *v2;
      *v2 = v11;
      Windows::AutoPointerBase<unsigned short const *,Windows::Auto<unsigned short const *>>::Close(
        (Windows::COM **)&Dst,
        v12);
      return 0i64;
    }
    v8 = -2147024882;
    v18 = -2147024882;
    Windows::AutoPointerBase<unsigned short const *,Windows::Auto<unsigned short const *>>::Close(
      (Windows::COM **)&Dst,
      v7);
    v16 = 2006;
    v14 = "base\\wcp\\dll\\createwin.cpp";
    v15 = "`anonymous-namespace'::ConvertLUnicodeStringToNullTerminatedString";
    v17 = "pszTemp.ResizeBufferNoPreserve(cchTotal)";
    Windows::ErrorHandling::COM::CBaseFrame<Windows::ErrorHandling::COM::CSimpleHResultCarryingFrame>::ReportErrorOrigination(
      &v18,
      (Windows::ErrorHandling::COM *)&v14);
  }
  return (unsigned int)v8;
}

调用

Set_g_pIMalloc();


LUNICODE_STRING name0;
RtlInitLUnicodeString(&name0, L"C:\\windows\\explorer.exe");

WCHAR *name2 = L"";
WCHAR** name3 = &name2;

ConvertLUnicodeStringToNullTerminatedString(&name0, name3);

printf("%ws\n", *name3);

Critical error detected c0000374

堆被破坏。

因此，在调用前对返回参数用 CoTaskMemAlloc 进行重新分配一下，就可以了。

*a2 = (WCHAR*)CoTaskMemAlloc(0);
UINT_PTR result = g_fnConvertLUnicodeStringToNullTerminatedString(a1, a2);