title: Create handle using NtOpenFile
body: <p><br />
  Hi, <br />
  i'm trying to implement a manual library mapper in Windows x64, <br />
  use the visual c++ compiler in vs2019. <br />
  I understand the concepts behind it and how to implement it,</p>
  <p>BUT...</p>
  <p>for some reason i failed to correctly open a handle to an existing file.<br />
  '_NtOpenFile' is correctly resolved before the code snippet. <br />
  (The value is checked and I can see in windbg that the code is jumping to the right function). <br />
  But I failed to use it correctly, I orientated after the documentation:</p>
  <p><a href="https://www.ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs" rel="nofollow noreferrer">https://www.ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs</a> <br />
  <a href="https://resources.infosecinstitute.com/topic/calling-ntdll-functions-directly/" rel="nofollow noreferrer">https://resources.infosecinstitute.com/topic/calling-ntdll-functions-directly/</a></p>
  <p>So my Question is, if I did anything wrong with NtOpenFile,
  maybe missunderstood a concept?
  What differ from NtOpenFile to the OpenFile-implementation of then winapi?</p>
  <pre><code>EXTERN_C NTSTATUS _NtOpenFile(
      OUT PHANDLE FileHandle,
      IN ACCESS_MASK DesiredAccess,
      IN POBJECT_ATTRIBUTES ObjectAttributes,
      OUT PIO_STATUS_BLOCK IoStatusBlock,
      IN ULONG ShareAccess,
      IN ULONG OpenOptions);
  </code></pre>
  <p>Is my NtOpenFile-definition, averything after the documentation.</p>
  <pre><code>WCHAR lib_name[] = L&quot;C:\\Windows\\System32\\rpcrt4.dll&quot;;
  UNICODE_STRING unicode_string;
  unicode_string.Buffer = &amp;lib_name;
  unicode_string.Length = 33 * sizeof(WCHAR);
  unicode_string.MaximumLength = 34 * sizeof(WCHAR);
  </code></pre>
  <p>My enviroment don't allow me to use RtlInitUnicodeString, <br />
  but the unicode string is initialized after the following documentation: <br />
  <a href="https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntstrsafe/nf-ntstrsafe-rtlunicodestringinitex" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntstrsafe/nf-ntstrsafe-rtlunicodestringinitex</a> (Remarks) <br />
  so it should be correctly initiaized.</p>
  <pre><code>NTSTATUS status = 0;
  HANDLE file_handle = NULL;
  OBJECT_ATTRIBUTES obj_attr;
  IO_STATUS_BLOCK status_block;
  
  InitializeObjectAttributes(&amp;obj_attr, &amp;unicode_string, OBJ_CASE_INSENSITIVE, NULL, NULL);
  
  wprintf(L&quot;Filename: %s\n&quot;, unicode_string.Buffer);
  
  if(!NT_SUCCESS(status = _NtOpenFile(&amp;file_handle, FILE_READ_DATA, &amp;obj_attr, &amp;status_block, FILE_SHARE_READ, FILE_SYNCHRONOUS_IO_NONALERT)))
  {
      printf(&quot;Couldnt open file, error: %i, status: %i&quot;, (int)GetLastError(), status);
      return NULL;
  }
  
  printf(&quot;Opened file&quot;);
  </code></pre>
  <p>Console:</p>
  <pre><code>Filename: C:\Windows\System32\rpcrt4.dll
  Couldnt open file, error: 0, status: -1073741811
  </code></pre>