c++ - Virtual ChannelInit 棒

Question

我正在开发一个 rdp 虚拟 channel 应用程序。我已经在注册表中注册了客户端 dll 并试图理解，客户端 dll 已加载。但是当从 pEntryPoints 调用 pVirtualChannelInit 时，我遇到了困难。它只是不返回任何结果，调试器转到此函数的反汇编代码。但是，如果不停止此调用，VirtualChannelEntry 会第二次调用(为什么？)。

如果我对 mstsc.exe 使用调试器。第一次通话后一段时间后，在控制台中我可以看到:mstsc.exe 中 0x00000004 处的第一次机会异常:0xC0000005:0x00000004 处的性能访问冲突。//translated with google当 rdp session 出现在屏幕上时，第二次调用后:

First-chance exception at 0x773EC42D (KernelBase.dll) in mstsc.exe: 0x000006BA: RPC server is unavailable.
First-chance exception at 0x773EC42D (KernelBase.dll) in mstsc.exe: 0x000006BA: RPC server is unavailable.
First-chance exception at 0x773EC42D (KernelBase.dll) in mstsc.exe: 0x000006BA: RPC server is unavailable.
First-chance exception at 0x773EC42D in mstsc.exe: Microsoft C++ exception: unsigned long at memory location 0x06CCF8C0.
First-chance exception at 0x773EC42D in mstsc.exe: Microsoft C++ exception: unsigned long at memory location 0x06CCF8C0.
First-chance exception at 0x773EC42D in mstsc.exe: Microsoft C++ exception: [rethrow] at memory location 0x00000000.
First-chance exception at 0x773EC42D in mstsc.exe: Microsoft C++ exception: [rethrow] at memory location 0x00000000.
First-chance exception at 0x773EC42D in mstsc.exe: Microsoft C++ exception: unsigned long at memory location 0x06CCF8C0.
First-chance exception at 0x773EC42D in mstsc.exe: Microsoft C++ exception: unsigned long at memory location 0x06CCF8C0.
First-chance exception at 0x773EC42D in mstsc.exe: Microsoft C++ exception: [rethrow] at memory location 0x00000000.
First-chance exception at 0x773EC42D in mstsc.exe: Microsoft C++ exception: [rethrow] at memory location 0x00000000.

pEntryPoints 中的指针总是:

pVirtualChannelInit - 0x00000004
pVirtualChannelOpen - 0x0000ffff
pVirtualChannelClose - 0x000000b8
pVirtualChannelWrite - 0x00000000(为什么是 0？)

HANDLE ClientHandle = NULL;
CHANNEL_DEF pChannel[1];
CHANNEL_ENTRY_POINTS SavedEntryPoints;
PCHANNEL_INIT_EVENT_FN pChannelInitEventProc;

BOOL VCAPITYPE VirtualChannelEntry(PCHANNEL_ENTRY_POINTS  pEntryPoints)
{
    ofstream myfile;
    myfile.open ("D:\\Projects\\bench_cli\\ConsoleApplication1\\Release\\example.txt");
    myfile << "Writing this to a file.\n";

    UINT retval1 = 0;
    ZeroMemory(&pChannel[0], sizeof(CHANNEL_DEF));
    strcpy(pChannel[0].name, "Bench");
    pChannel[0].options = CHANNEL_OPTION_ENCRYPT_RDP | CHANNEL_OPTION_COMPRESS_RDP;
    pChannelInitEventProc = VirtualChannelInitEvent;
    memcpy(&SavedEntryPoints, pEntryPoints, sizeof(CHANNEL_ENTRY_POINTS));

    myfile << " copied" << endl;

    // call VirtualChannelInit using the function pointer in
    // PCHANNEL_ENTRY_POINTS
    myfile << "Initing" << endl;

    retval1 = pEntryPoints->pVirtualChannelInit (&ClientHandle,
                pChannel, 1, VIRTUAL_CHANNEL_VERSION_WIN2000,
                pChannelInitEventProc); //here we stuck

    myfile << " init" << endl; //this never printed
    myfile.close();

    return TRUE;
}

VOID VCAPITYPE VirtualChannelInitEvent( LPVOID pInitHandle, UINT event, LPVOID pData, UINT dataLength)
{
...//never called
}

Answer 1

pVirtualChannelInit 应该是一个有效的指针(指向代码)。 0x00000004 不是，因此访问冲突

您的问题可能是编译时结构打包/对齐不当造成的。

使用调试器通过检查传递给 VirtualChannelEntry 实现的 PCHANNEL_ENTRY_POINTS pEntryPoints 参数指向的内存，找出正确的对齐方式。该结构以 2 个32 位 值开始，后跟 4 个函数指针。第一个字段是大小字段(值取决于位数，32 位:0x0018 或 64:0x0028)，第二个应该是 0x00001。

然后，使用 #pragma pack push/pop(MSVC 编译器)围绕包含定义 CHANNEL_ENTRY_POINTS 结构的 header ，以在编译时强制正确对齐。