0

Recently, I have a problem when writing a Windows driver. Using RtlAppendUnicodeStringToString to concatenate several UNICODE_STRINGs continuously will cause a kernel crash. I have locked the problem in the following code, please help me solve this problem, thanks

KeStackAttachProcess( Process, &apcstate );
PPEB peb = PsGetProcessPeb( Process );
if ( peb != NULL )
{
    UNICODE_STRING  NewBuffer   = RTL_CONSTANT_STRING( L"\"" );
    UNICODE_STRING  Buffer      = peb->ProcessParameters->ImagePathName;

    UNICODE_STRING suffix = RTL_CONSTANT_STRING( L"\" --DEBUGMODE" );
    NewBuffer.MaximumLength = Buffer.MaximumLength + NewBuffer.MaximumLength;

    RtlAppendUnicodeStringToString( &NewBuffer, &Buffer );
    NewBuffer.MaximumLength = suffix.MaximumLength + NewBuffer.MaximumLength;
    RtlAppendUnicodeStringToString( &NewBuffer, &suffix );

    peb->ProcessParameters->CommandLine.MaximumLength   = NewBuffer.MaximumLength;
    peb->ProcessParameters->CommandLine         = NewBuffer;
}
KeUnstackDetachProcess( &apcstate );

If I replace the problematic code above with the following, it works fine, but it doesn't do what I want

KeStackAttachProcess( Process, &apcstate );
PPEB peb = PsGetProcessPeb( Process );
if ( peb != NULL )
{
    UNICODE_STRING  Buffer      = peb->ProcessParameters->ImagePathName;

    UNICODE_STRING suffix = RTL_CONSTANT_STRING( L" --DEBUGMODE" );

    Buffer.MaximumLength = suffix.MaximumLength + Buffer.MaximumLength;
    RtlAppendUnicodeStringToString( &Buffer, &suffix );

    peb->ProcessParameters->CommandLine.MaximumLength   = Buffer.MaximumLength;
    peb->ProcessParameters->CommandLine         = Buffer;
}
KeUnstackDetachProcess( &apcstate );
Haru1ca
  • 19
  • 1
  • I need to get the ImagePath of the program, and add a " in front and a " --DEBUGMODE in the back as its CommandLine. – Haru1ca Mar 26 '23 at 09:45
  • RtlAppendUnicodeStringToString() just copies bytes around. You need to allocate a large enough buffer. As is, you're going to write past the end of the buffer and blow something up. – Luke Mar 30 '23 at 17:40

0 Answers0