title: Hooked NtOpenFile fails when std::wstring is defined on the stack
body: <p>I have written a hooking dll using the <a href="http://codefromthe70s.org/mhook23.aspx" rel="nofollow"><code>mhook library</code></a>. In a spezial case the <code>NtOpenFile()</code> fails when a <code>std::wstring</code> is defined as <code>stack var</code>. Defining it on the <code>heap</code> the code is <code>working</code>.</p>
  
  <p>The code is working without problems except when a certain <code>win32 application</code> (lets call it nuisance.exe) tries to open an existing testfile (like c:\temp\anyfile.log) the <code>access fails</code>. Mostly STATUS_INVALID_ACL (0xC0000077) is returned then.</p>
  
  <p>I have <code>reduced my code</code> line by line and finally found that the error happens when in a called function a std::wstring is defined (this example below). The error happens every time an on different OS's</p>
  
  <pre><code>NTSTATUS NtOpenFileApiHook::NtOpenFileHook(PHANDLE              FileHandle,
                                    ACCESS_MASK           DesiredAccess,
                                    POBJECT_ATTRIBUTES    ObjectAttributes,
                                    PIO_STATUS_BLOCK      IoStatusBlock,
                                    ULONG                 ShareAccess,
                                    ULONG                 OpenOptions 
                                    )
  {
      NTSTATUS Status = STATUS_SUCCESS;
  
      // using this function the call will fail
      AfterThis_NtOpenFile_WillFail();
  
      // using this function INSTEAD the call will work
      AfterThis_NtOpenFile_WillWork();
  
      // calling the real NtOpenFile using a pointer
      // nothing was changed hier, the original parameters are passed
      Status = RealNtOpenFile(FileHandle, ...);
  
      return Status;
  }
  
  int AfterThis_NtOpenFile_WillFail()
  {
      std::wstring String = L"";
  
      return 0;
  }
  
  int AfterThis_NtOpenFile_WillWork()
  {
      std::wstring * pString = new std::wstring();
      pString-&gt;assign(L"");
      delete pString;
  
      return 0;
  }
  </code></pre>
  
  <p>I have fixed it this way for this call. But I'm afraid that other functions in other circumstainces could fail so I'm looking for the reason and (probably) for a solution. </p>
  
  <p>Nuisance.exe is a C# application with default stacksize callling a win32 dll about which I know nothing.</p>