使用MiniDump获取句柄信息会导致ArgumentException

Question

我正在尝试获取一些进程的句柄的微小信息。我得到了一个MINIDUMP_HANDLE_DESCRIPTOR_2类型句柄的列表，我正在尝试阅读有关ObjectInfoRva可以访问的句柄的信息。

然而，我总是得到这样的例外：

System.ArgumentException发生了HResult=-2147024809 Message=Not，缓冲区中有足够的可用空间。Source=mscorlib

那是我的方法

public unsafe DbgHelp.MINIDUMP_HANDLE_OBJECT_INFORMATION ReadInfo(uint rva)
{
    try
    {
        DbgHelp.MINIDUMP_HANDLE_OBJECT_INFORMATION result = default(DbgHelp.MINIDUMP_HANDLE_OBJECT_INFORMATION);
        byte* baseOfView = null;
        _safeMemoryMappedViewHandle.AcquirePointer(ref baseOfView);

        IntPtr position = new IntPtr(baseOfView + rva);

        result = _safeMemoryMappedViewHandle.Read<DbgHelp.MINIDUMP_HANDLE_OBJECT_INFORMATION>((ulong)position);
        return result;
    }
    finally
    {
        _safeMemoryMappedViewHandle.ReleasePointer();
    }
}

MINIDUMP_HANDLE_DESCRIPTOR_2声明：

 public struct MINIDUMP_HANDLE_DESCRIPTOR_2
{
    public UInt64 Handle;
    public uint TypeNameRva;
    public uint ObjectNameRva;
    public UInt32 Attributes;
    public UInt32 GrantedAccess;
    public UInt32 HandleCount;
    public UInt32 PointerCount;
    public uint ObjectInfoRva;
    public UInt32 Reserved0;
}

_safeMemoryMappedViewHandle是初始化的--这就是我第一次获得句柄列表的方式。

我做错了什么？

Answer 1

问题在于baseOfView指针--我没有正确计算它。我需要相应地将偏移量设置为基本流地址..。

下面是ReadInfo函数的一个版本，它最终对我起了作用：

public unsafe DbgHelp.MINIDUMP_HANDLE_OBJECT_INFORMATION ReadInfo(uint rva, IntPtr streamPtr)
{
    DbgHelp.MINIDUMP_HANDLE_OBJECT_INFORMATION result = new DbgHelp.MINIDUMP_HANDLE_OBJECT_INFORMATION();

    try
    {
        byte* baseOfView = null;
        _safeMemoryMappedViewHandle.AcquirePointer(ref baseOfView);
        ulong offset = (ulong)streamPtr - (ulong)baseOfView;
        result = _safeMemoryMappedViewHandle.Read<DbgHelp.MINIDUMP_HANDLE_OBJECT_INFORMATION>(offset);
    }
    finally
    {
        _safeMemoryMappedViewHandle.ReleasePointer();
    }

    return result;
}