Im trying to set a instrumentation callback on another process but it gives me 0xc000000d (STATUS_INVALID_PARAMETER) but if I set it on the current process then it succeeds.

Does anyone know what I am doing wrong.

#define ProcessInstrumentationCallback 0x28

typedef struct _ProcessInstrumentationCallback
{
    ULONG version;
    ULONG reserved;
    PVOID callback;
};

extern "C"
{
    NTSTATUS NtSetInformationProcess(HANDLE ProcessHandle, PROCESSINFOCLASS ProcessInformationClass, PVOID ProcessInformation, ULONG ProcessInformationLength);
}

const auto process_handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, process_id);
if (!is_handle_valid(process_handle))
{
    printf("Unable to open handle: 0x%x\n", process_handle);
    return 0;
}
printf("Handle: 0x%x\n", process_handle);

_ProcessInstrumentationCallback info;
info.callback = nullptr;
info.reserved = 0;
info.version = 0;

NTSTATUS status = NtSetInformationProcess(process_handle, (PROCESSINFOCLASS)ProcessInstrumentationCallback, &info, sizeof(info));
printf("0x%x\n", status);

Im trying to set a instrumentation callback on another process but it gives me 0xc000000d (STATUS_INVALID_PARAMETER) but if I set it on the current process then it succeeds.

Does anyone know what I am doing wrong.

#define ProcessInstrumentationCallback 0x28

typedef struct _ProcessInstrumentationCallback
{
    ULONG version;
    ULONG reserved;
    PVOID callback;
};

extern "C"
{
    NTSTATUS NtSetInformationProcess(HANDLE ProcessHandle, PROCESSINFOCLASS ProcessInformationClass, PVOID ProcessInformation, ULONG ProcessInformationLength);
}

const auto process_handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, process_id);
if (!is_handle_valid(process_handle))
{
    printf("Unable to open handle: 0x%x\n", process_handle);
    return 0;
}
printf("Handle: 0x%x\n", process_handle);

_ProcessInstrumentationCallback info;
info.callback = nullptr;
info.reserved = 0;
info.version = 0;

NTSTATUS status = NtSetInformationProcess(process_handle, (PROCESSINFOCLASS)ProcessInstrumentationCallback, &info, sizeof(info));
printf("0x%x\n", status);

• windows
• kernel
• 64-bit
• ntdll

1 Answer 1

I fixed it by allocating a buffer in the target process and writing the structure to the buffer then changing the ProcessInformation argument to a pointer to the buffer and changing ProcessInformationLength to the size of the buffer