LsaOpenPolicy : Attempted to read or write protected memory

[Adrian Wallis]

Hello,

I'm trying to call LsaOpenPolicy, but get the error
'System.AccessV iolationExcepti on'.

I originally tried a conversion from working VB6 code and I've compared
the code with working C# code and cannot see where the problem lies -
can anyone help to point out the problem please:

Structure LSA_UNICODE_STR ING
Dim Length As Short
Dim MaximumLength As Short
Dim Buffer As String
End Structure
Structure LSA_OBJECT_ATTR IBUTES
Dim Length As Integer
Dim RootDirectory As IntPtr
Dim ObjectName As IntPtr
Dim Attributes As Integer
Dim SecurityDescrip tor As IntPtr
Dim SecurityQuality OfService As IntPtr
End Structure
Declare Unicode Function LsaOpenPolicy Lib "advapi32.d ll" (ByRef
SystemName() As LSA_UNICODE_STR ING, ByRef ObjectAttribute s As
LSA_OBJECT_ATTR IBUTES, ByVal DesiredAccess As Int32, ByRef PolicyHandle
As IntPtr) As Int32
Private POLICY_ALL_ACCE SS As Integer = &HF0FFF

Private Sub Form1_Load(ByVa l sender As Object, ByVal e As
System.EventArg s) Handles Me.Load
Dim SystemName(0) As LSA_UNICODE_STR ING
SystemName(0) = New LSA_UNICODE_STR ING
'initialize a pointer for the policy handle
Dim PolicyHandle As IntPtr = IntPtr.Zero
'these attributes are not used, but LsaOpenPolicy wants them to
exists
Dim ObjectAttribute s As New LSA_OBJECT_ATTR IBUTES
ObjectAttribute s.RootDirectory = IntPtr.Zero
ObjectAttribute s.ObjectName = IntPtr.Zero
ObjectAttribute s.Attributes = 0
ObjectAttribute s.SecurityDescr iptor = IntPtr.Zero
ObjectAttribute s.SecurityQuali tyOfService = IntPtr.Zero
ObjectAttribute s.Length = 24 ' IN C# :
Marshal.SizeOf( typeof(LSA_OBJE CT_ATTRIBUTES)) ;
'get a policy handle
SystemName(0).L ength = "192.168.1.1".L ength * 2 ' Can't get
UnicodeEncoding .CharSize to work? How to declare?
SystemName(0).M aximumLength = ("192.168.1.1". Length + 1) * 2 '
Can't get UnicodeEncoding .CharSize to work? How to declare?
SystemName(0).B uffer = "192.168.1. 1"
Dim ResultPolicy As UInteger
Dim Access = POLICY_ALL_ACCE SS
ResultPolicy = LsaOpenPolicy(S ystemName, ObjectAttribute s,
Access, PolicyHandle)

Many thanks
Adrian

[Mattias Sjögren]

Adrian,

Declare Unicode Function LsaOpenPolicy Lib "advapi32.d ll" (ByRef
SystemName() As LSA_UNICODE_STR ING, ByRef ObjectAttribute s As
LSA_OBJECT_ATT RIBUTES, ByVal DesiredAccess As Int32, ByRef PolicyHandle
As IntPtr) As Int32

The first parameter shouldn't be an array, just a single
LSA_UNICODE_STR ING.

'these attributes are not used, but LsaOpenPolicy wants them to
exists
Dim ObjectAttribute s As New LSA_OBJECT_ATTR IBUTES
ObjectAttribute s.RootDirectory = IntPtr.Zero
ObjectAttribute s.ObjectName = IntPtr.Zero
ObjectAttribute s.Attributes = 0
ObjectAttribute s.SecurityDescr iptor = IntPtr.Zero
ObjectAttribute s.SecurityQuali tyOfService = IntPtr.Zero
ObjectAttribute s.Length = 24 ' IN C# :
Marshal.SizeOf (typeof(LSA_OBJ ECT_ATTRIBUTES) );

FYI, all members are initialized to zero by default so doing it
explicitly isn't really needed.

And you can use Marshal.SizeOf from VB as well.
Mattias

--
Mattias Sjögren [C# MVP] mattias @ mvps.org
http://www.msjogren.net/dotnet/ | http://www.dotnetinterop.com
Please reply only to the newsgroup.

[Adrian Wallis]

Thanks for that, the problem appears to be with the LSA_UNICODE_STR ING
part.

If I set pass it as NOTHING it works fine and gets a handle to local
machine, the problem comes when I try to use it on a remote computer.

Having stepped through the C# version and the VB.NET version I cannot
see any differences in what is being passed, or how it's being passed.

I'm totallay stumped as to what's causing the error.
Mattias Sjögren wrote:

Adrian,

Declare Unicode Function LsaOpenPolicy Lib "advapi32.d ll" (ByRef
SystemName() As LSA_UNICODE_STR ING, ByRef ObjectAttribute s As
LSA_OBJECT_ATTR IBUTES, ByVal DesiredAccess As Int32, ByRef PolicyHandle
As IntPtr) As Int32

The first parameter shouldn't be an array, just a single
LSA_UNICODE_STR ING.

'these attributes are not used, but LsaOpenPolicy wants them to
exists
Dim ObjectAttribute s As New LSA_OBJECT_ATTR IBUTES
ObjectAttribute s.RootDirectory = IntPtr.Zero
ObjectAttribute s.ObjectName = IntPtr.Zero
ObjectAttribute s.Attributes = 0
ObjectAttribute s.SecurityDescr iptor = IntPtr.Zero
ObjectAttribute s.SecurityQuali tyOfService = IntPtr.Zero
ObjectAttribute s.Length = 24 ' IN C# :
Marshal.SizeOf( typeof(LSA_OBJE CT_ATTRIBUTES)) ;

FYI, all members are initialized to zero by default so doing it
explicitly isn't really needed.

And you can use Marshal.SizeOf from VB as well.
Mattias

--
Mattias Sjögren [C# MVP] mattias @ mvps.org
http://www.msjogren.net/dotnet/ | http://www.dotnetinterop.com
Please reply only to the newsgroup.

[Adrian Wallis]

I've managed to fix the first error with the following code:

Dim SystemName As LSA_UNICODE_STR ING
SystemName = New LSA_UNICODE_STR ING
UserAccount = "tenyas\zwa n"
Dim ObjectAttribute s As New LSA_OBJECT_ATTR IBUTES
'get a policy handle
SystemName = InitLSAString(" ")
Dim ResultPolicy As Integer
Dim Access = POLICY_ALL_ACCE SS
ResultPolicy = LsaOpenPolicy(S ystemName, ObjectAttribute s,
Access, PolicyHandle)
If ResultPolicy <0 Then
Debug.Print(Lsa NtStatusToWinEr ror(ResultPolic y))
End If

which works fine. As soon as I add a remote machine name though, it
fails with error 1722 (RPC Server unavailable), I know this isn't the
case as it happens against any machine. I can only assume that the name
isn't being passed correctly as unicode?

Please help someone - it's driving me crazy.

Thanks
Adrian

Adrian Wallis wrote:

Thanks for that, the problem appears to be with the LSA_UNICODE_STR ING
part.

If I set pass it as NOTHING it works fine and gets a handle to local
machine, the problem comes when I try to use it on a remote computer.

Having stepped through the C# version and the VB.NET version I cannot
see any differences in what is being passed, or how it's being passed.

I'm totallay stumped as to what's causing the error.
Mattias Sjögren wrote:

Adrian,

Declare Unicode Function LsaOpenPolicy Lib "advapi32.d ll" (ByRef
>SystemName() As LSA_UNICODE_STR ING, ByRef ObjectAttribute s As
>LSA_OBJECT_ATT RIBUTES, ByVal DesiredAccess As Int32, ByRef PolicyHandle
>As IntPtr) As Int32

The first parameter shouldn't be an array, just a single
LSA_UNICODE_STR ING.

'these attributes are not used, but LsaOpenPolicy wants them to
>exists
Dim ObjectAttribute s As New LSA_OBJECT_ATTR IBUTES
ObjectAttribute s.RootDirectory = IntPtr.Zero
ObjectAttribute s.ObjectName = IntPtr.Zero
ObjectAttribute s.Attributes = 0
ObjectAttribute s.SecurityDescr iptor = IntPtr.Zero
ObjectAttribute s.SecurityQuali tyOfService = IntPtr.Zero
ObjectAttribute s.Length = 24 ' IN C# :
>Marshal.SizeOf (typeof(LSA_OBJ ECT_ATTRIBUTES) );

FYI, all members are initialized to zero by default so doing it
explicitly isn't really needed.

And you can use Marshal.SizeOf from VB as well.
Mattias

--
Mattias Sjögren [C# MVP] mattias @ mvps.org
http://www.msjogren.net/dotnet/ | http://www.dotnetinterop.com
Please reply only to the newsgroup.

[Adrian Wallis]

I've managed to fix the problem by changing the structure slightly:

Structure LSA_UNICODE_STR ING
Dim Length As Short
Dim MaximumLength As Short

<System.Runtime .InteropService s.MarshalAs(Run time.InteropSer vices.Unmanaged Type.LPWStr)>
Dim buffer As String
End Structure

The full code if anyone wants is :

Structure LSA_UNICODE_STR ING
Dim Length As Short
Dim MaximumLength As Short

<System.Runtime .InteropService s.MarshalAs(Run time.InteropSer vices.Unmanaged Type.LPWStr)>
Dim buffer As String
End Structure
Public Enum SID_NAME_USE
SidTypeUser = 1
SidTypeGroup = 2
SidTypeDomain = 3
SidTypeAlias = 4
SidTypeWellKnow nGroup = 5
SidTypeDeletedA ccount = 6
SidTypeInvalid = 7
SidTypeUnknown = 8
End Enum
Structure LSA_OBJECT_ATTR IBUTES
Dim Length As Integer
Dim RootDirectory As IntPtr
Dim ObjectName As IntPtr
Dim Attributes As Integer
Dim SecurityDescrip tor As IntPtr
Dim SecurityQuality OfService As IntPtr
End Structure
Structure LSA_translated_ sid
Dim use As SID_NAME_USE
Dim RelativeID As ULong
Dim DomainIndex As Long
End Structure
Public UserAccount As String
Dim PolicyHandle As IntPtr = IntPtr.Zero
Private Declare Function LsaNtStatusToWi nError Lib "advapi32.d ll"
(ByVal NTStatus As Int32) As Int32
Declare Unicode Function LsaOpenPolicy Lib "advapi32.d ll" (ByRef
SystemName As LSA_UNICODE_STR ING, ByRef ObjectAttribute s As
LSA_OBJECT_ATTR IBUTES, ByVal DesiredAccess As Int32, ByRef PolicyHandle
As IntPtr) As Int32
Private POLICY_ALL_ACCE SS As Integer = &HF0FFF
Private Declare Auto Function LookupAccountNa me Lib "advapi32.d ll"
(ByVal lpSystemName As String, ByVal lpAccountName As String, ByVal Sid
As IntPtr, ByRef cbSid As Integer, ByVal lpReferenceDoma inName As
String, ByRef cchReferencedDo mainName As Integer, ByRef peUse As
Integer) As Boolean
Private Declare Unicode Function LsaAddAccountRi ghts Lib
"advapi32.d ll" (ByVal PolicyHandle As IntPtr, ByVal AccountSid As
IntPtr, ByRef UserRights As LSA_UNICODE_STR ING, ByVal CountOfRights As
Int32) As Int32
Private Sub Form1_Load(ByVa l sender As Object, ByVal e As
System.EventArg s) Handles Me.Load
Dim SystemName As LSA_UNICODE_STR ING
SystemName = New LSA_UNICODE_STR ING
UserAccount = "domain\use r"
Dim ObjectAttribute s As New LSA_OBJECT_ATTR IBUTES
'get a policy handle
SystemName = InitLSAString(" 192.168.1.1")
Dim ResultPolicy As Integer
Dim Access = POLICY_ALL_ACCE SS
ResultPolicy = LsaOpenPolicy(S ystemName, ObjectAttribute s,
Access, PolicyHandle)
If ResultPolicy <0 Then
Debug.Print(Lsa NtStatusToWinEr ror(ResultPolic y))
End If
Dim tSID As IntPtr
Dim lngUse As Int32 = 0
tSID = fncLookupAccoun tName("192.168. 1.1", "domain\use r", tSID,
Nothing, lngUse)
Dim Privileges As LSA_UNICODE_STR ING = New LSA_UNICODE_STR ING
Privileges = InitLSAString(" SeServiceLogonR ight")
Dim test As Integer
test = LsaAddAccountRi ghts(PolicyHand le, tSID, Privileges, 1)
Debug.Print(Lsa NtStatusToWinEr ror(test))
End Sub
Public Function fncLookupAccoun tName(ByVal strSystemName As String,
ByVal strName As String, ByVal tSID As IntPtr, ByRef
strReferencedDo mainName As String, ByRef lngUse As Long) As Long
Dim ret As Boolean
Dim ptrSid As IntPtr
Dim cbSid As Integer
Dim refDomainName As New System.Text.Str ingBuilder
Dim cbRefDomainName As Integer
Dim peUse As SID_NAME_USE
'First get the buffer sizes
ret = LookupAccountNa me(strSystemNam e, strName, Nothing, cbSid,
Nothing, cbRefDomainName , peUse)
'Adjust the buffers to the needed size
ptrSid =
System.Runtime. InteropServices .Marshal.AllocH Global(cbSid)
refDomainName.E nsureCapacity(c bRefDomainName)
'Get the data again, now with the changed buffers
ret = LookupAccountNa me(strSystemNam e, strName, ptrSid, cbSid,
refDomainName.T oString, cbRefDomainName , peUse)
If ret Then
Return ptrSid
End If
End Function
Public Function InitLSAString(B yVal Input As String) As
LSA_UNICODE_STR ING
Dim LSAString As New LSA_UNICODE_STR ING
LSAString.Lengt h = Input.Length *
System.Text.Uni codeEncoding.Ch arSize
LSAString.Maxim umLength = (Input.Length + 1) *
System.Text.Uni codeEncoding.Ch arSize
LSAString.buffe r = Input
Return LSAString
End Function

I hope this helps someone.
Adrian