doutongwei4380
2019-07-18 03:50
浏览 211
已采纳

Windows API错误“句柄无效”

I'm trying to create a program that utilises the MiniDumpWriteDump Windows API to dump another process's memory. However, it keeps returning an error saying The handle is invalid. I'm pretty confident in my process handle because I've used the OpenProcess Windows API before, so I think it's how I'm using CreateFileW.

I have looked at examples online like this one but I can't get anything working.

Here is my code so far:

package main

import (
    "fmt"
    "os"
    "strconv"
    "syscall"
    "unsafe"
)

var kernel32        = syscall.NewLazyDLL("kernel32.dll")
var procOpenProcess = kernel32.NewProc("OpenProcess")
var procCreateFileW = kernel32.NewProc("CreateFileW")
var procCloseHandle = kernel32.NewProc("CloseHandle")

var dbghelp               = syscall.NewLazyDLL("Dbghelp.dll")
var procMiniDumpWriteDump = dbghelp.NewProc("MiniDumpWriteDump")

func main() {
    fmt.Println("[ ] Starting Enum-DumpProcessMemory
")

    pid, _ := strconv.Atoi(os.Args[1])
    fmt.Println("[-] PID            :", pid)

    processHandle, _, _ := procOpenProcess.Call(uintptr(0xFFFF), uintptr(1), uintptr(pid))
    fmt.Println("[-] Process Handle :", processHandle)

    path, _ := syscall.UTF16PtrFromString(os.Args[2])
    fileHandle, _, _ := procCreateFileW.Call(uintptr(unsafe.Pointer(path)), syscall.GENERIC_READ, syscall.FILE_SHARE_READ|syscall.FILE_SHARE_WRITE, 0, syscall.OPEN_EXISTING, syscall.FILE_ATTRIBUTE_NORMAL, 0)
    fmt.Println("[-] File Handle    :", fileHandle)

    ret, _, err := procMiniDumpWriteDump.Call(uintptr(processHandle), uintptr(pid), uintptr(fileHandle), 0x00061907, 0, 0, 0)

    if ret != 0 {
        fmt.Println("[+] Process memory dump successful")
    } else {
        fmt.Println("[x] Process memory dump not successful")
        fmt.Println(err)
    }
}

Here is the output:

> .\Enum-DumpProcessMemory.exe 6892 C:\Users\user\Documents\dump.dmp
[ ] Starting Enum-DumpProcessMemory

[-] PID            : 6892
[-] Process Handle : 236
[-] File Handle    : 18446744073709551615
[x] Process memory dump not successful
The handle is invalid.
  • 写回答
  • 好问题 提建议
  • 追加酬金
  • 关注问题
  • 邀请回答

1条回答 默认 最新

  • dswfyq6201 2019-07-18 04:50
    最佳回答

    I got the code working thanks to the help from Jonathan Potter. The problem was that I was trying to create a handler to a file that didn't exist.

    Here is my working code:

    package main
    
    import (
        "fmt"
        "os"
        "strconv"
        "syscall"
        "unsafe"
    )
    
    var kernel32        = syscall.NewLazyDLL("kernel32.dll")
    var procOpenProcess = kernel32.NewProc("OpenProcess")
    var procCreateFileW = kernel32.NewProc("CreateFileW")
    
    var dbghelp               = syscall.NewLazyDLL("Dbghelp.dll")
    var procMiniDumpWriteDump = dbghelp.NewProc("MiniDumpWriteDump")
    
    func main() {
        fmt.Println("[ ] Starting Enum-DumpProcessMemory
    ")
    
        pid, _ := strconv.Atoi(os.Args[1])
        fmt.Println("[-] PID            :", pid)
    
        processHandle, _, _ := procOpenProcess.Call(uintptr(0xFFFF), uintptr(1), uintptr(pid))
        fmt.Println("[-] Process Handle :", processHandle)
    
        if _, err := os.Stat(os.Args[2]); os.IsNotExist(err) {
            os.Create(os.Args[2])
        }
        path, _ := syscall.UTF16PtrFromString(os.Args[2])
    
        fileHandle, _, _ := procCreateFileW.Call(uintptr(unsafe.Pointer(path)), syscall.GENERIC_WRITE, syscall.FILE_SHARE_READ|syscall.FILE_SHARE_WRITE, 0, syscall.OPEN_EXISTING, syscall.FILE_ATTRIBUTE_NORMAL, 0)
        fmt.Println("[-] File Handle    :", fileHandle)
    
        ret, _, err := procMiniDumpWriteDump.Call(uintptr(processHandle), uintptr(pid), uintptr(fileHandle), 0x00061907, 0, 0, 0)
    
        if ret != 0 {
            fmt.Println("[+] Process memory dump successful")
        } else {
            fmt.Println("[x] Process memory dump not successful")
            fmt.Println(err)
        }
    }
    
    评论
    解决 无用
    打赏 举报

相关推荐 更多相似问题