How to fix exit code 0xc0000005 (STATUS_ACCESS_VIOLATION) on NtAllocateVirtualMemory?

2k Views Asked by At

I am trying to allocate space in memory with ntdll.dll. I am using the NtApi and winapi crates.

When I try to allocate, I get the next error:

exit code: 0xc0000005, STATUS_ACCESS_VIOLATION

How do I need to send the pointer to NtAllocateVirtualMemory()?

Why does VirtualAllocEx() work?

I understand when I call VirtualAllocEx(), the process is kernel32.dll -> ntdll.dll, so why doesn't this work when I send this to NtAllocateVirtualMemory()?

main.rs

use ntapi::ntmmapi::NtAllocateVirtualMemory;
use ntapi::ntpsapi::NtCurrentProcess;
use ntapi::winapi::um::winnt::{MEM_COMMIT, MEM_RESERVE, PAGE_READWRITE};
use winapi::shared::ntdef::{NT_SUCCESS};
use ntapi::_core::ptr::null_mut;

fn main() {
    unsafe {
        // let null_ptr=std::ptr::null();
        // let null_base:*const winapi::ctypes::c_void=null_ptr as *const _;
        let mut buffer=null_mut();
        let status = NtAllocateVirtualMemory(
            NtCurrentProcess,
            *buffer,
            0,
            0x1000 as *mut _,
            MEM_COMMIT | MEM_RESERVE,
            PAGE_READWRITE,
        );

        if !NT_SUCCESS(status) {
        // if status as usize == 0x0 {
            println!("Allocation Fails");
        } else {
            println!("Allocation Success");
        }
    }
}

Cargo.toml

[package]
name = "allocate_null"
version = "0.1.0"
edition = "2018"

[dependencies]
winapi = {version="0.3.9", features=["ntdef","winnt","memoryapi"]}
ntapi = "0.3.6"
0

There are 0 best solutions below