为什么NtOpenSection返回错误号0xc0000024?

时间:2018-07-10 13:52:36

标签: c reverse-engineering

我想调用NtOpensection但返回0xc0000024错误

UNICODE_STRING ObFileName;
OBJECT_ATTRIBUTES objA;
HANDLE hSectionHandle = NULL;

RtlInitUnicodeString(&ObFileName, L"\\??\\E:\\Myfile.dat");
InitializeObjectAttributes(&objA, &ObFileName, OBJ_CASE_INSENSITIVE, (HANDLE)NULL, (PSECURITY_DESCRIPTOR)NULL);
NTSTATUS ntStatus = _NtOpenSection(&hSectionHandle, SECTION_MAP_READ | SECTION_MAP_WRITE, &objA);

1 个答案:

答案 0 :(得分:0)

对于什么,该错误意味着什么,您可以检查here

|===============================|=====================================================|
| 0xC0000024                    | {Wrong Type} There is a mismatch between the type   |
| STATUS_OBJECT_TYPE_MISMATCH   | of object that is required by the requested         |
|                               | operation and the type of object that               |
|                               | is specified in the request.                        |
|===============================|=====================================================|

关于为什么,这由您确定。确保"\\??\\E:\\Myfile.dat"是有效的节对象的有效名称。