NtConnectPort error

Question

I try to call the function NtConnectPort - I create a section and then forward this section to NtConnectPort .

I get a running error from the function NtConnectPort. The return value is c000000d - The parameter is incorrect.

I don't understand why. Any ideas?

The code:

HANDLE hSection=0;
LARGE_INTEGER SecSize;

SecSize.LowPart=0x10000;
SecSize.HighPart=0x0;

if(NtCreateSection(&hSection, SECTION_ALL_ACCESS, NULL, &SecSize, PAGE_READWRITE,SEC_COMMIT ,NULL))
{
    printf("couldn't create a section");
}

HANDLE hPort;
LPC_SECTION_OWNER_MEMORY sectionInfo;
LPC_SECTION_MEMORY mapInfo;
byte ConnectDataBuffer[0x100];
DWORD Size = sizeof(ConnectDataBuffer);
UNICODE_STRING uStr;
WCHAR * uString=L"\\SmApiPort";
DWORD maxSize;
SECURITY_QUALITY_OF_SERVICE qos;

for (int i=0 ; i < 0x100 ; i++)
{
    ConnectDataBuffer[i]=0x0;
}

memset(&sectionInfo, 0, sizeof(sectionInfo));
memset(&mapInfo, 0, sizeof(mapInfo));

sectionInfo.Length = 24;
sectionInfo.SectionHandle =hSection;
sectionInfo.ViewSize = 0x10000;

mapInfo.Length = 0x0C;

uStr.Length = wcslen(uString)*2;
uStr.MaximumLength = wcslen(uString)*2+2;
uStr.Buffer =uString;


NTSTATUS res = NtConnectPort(&hPort,&uStr,&qos,(LPC_SECTION_OWNER_MEMORY*)&sectionInfo,(LPC_SECTION_MEMORY*)&mapInfo,&maxSize,(DWORD*)ConnectDataBuffer,&Size);
if (res)
{
    printf("Could not connect to LPC port.\n -%x", res);
    return 1;
}



typedef struct _LPC_SECTION_OWNER_MEMORY {
ULONG                   Length;
HANDLE                  SectionHandle;
ULONG                   OffsetInSection;
ULONG                   ViewSize;
PVOID                   ViewBase;
PVOID                   OtherSideViewBase;
} LPC_SECTION_OWNER_MEMORY, *PLPC_SECTION_OWNER_MEMORY;

typedef struct _LPC_SECTION_MEMORY {
ULONG                   Length;
ULONG                   ViewSize;
PVOID                   ViewBase;
} LPC_SECTION_MEMORY, *PLPC_SECTION_MEMORY;


NTSYSAPI NTSTATUS NTAPI NtConnectPort(
OUT PHANDLE PortHandle,
IN  PUNICODE_STRING PortName,
IN  PSECURITY_QUALITY_OF_SERVICE SecurityQos,
//IN  OUT PPORT_VIEW ClientView OPTIONAL,
IN OUT PLPC_SECTION_OWNER_MEMORY ClientSharedMemory,
OUT PLPC_SECTION_MEMORY ServerSharedMemory,
//OUT PREMOTE_PORT_VIEW ServerView OPTIONAL,
OUT PULONG MaxMessageLength OPTIONAL,
IN  OUT PVOID ConnectionInformation OPTIONAL,
IN  OUT PULONG ConnectionInformationLength OPTIONAL
);


NTSYSAPI NTSTATUS NTAPI ZwConnectPort(
OUT PHANDLE PortHandle,
IN  PUNICODE_STRING PortName,
IN  PSECURITY_QUALITY_OF_SERVICE SecurityQos,
IN OUT PLPC_SECTION_OWNER_MEMORY ClientSharedMemory,
OUT PLPC_SECTION_MEMORY ServerSharedMemory,
//IN OUT int int1,
//IN  OUT PPORT_VIEW ClientView OPTIONAL,
//OUT PREMOTE_PORT_VIEW ServerView OPTIONAL,
OUT PULONG MaxMessageLength OPTIONAL,
IN  OUT PVOID ConnectionInformation OPTIONAL,
IN  OUT PULONG ConnectionInformationLength OPTIONAL
);

Answer 1

You're not initializing the qos variable (http://msdn.microsoft.com/en-us/library/windows/desktop/aa379574(v=vs.85).aspx)

SecurityQos - Points to a structure that specifies the level of impersonation available to the port listener.