How to set PUNICODE_STRING without RtlInitUnicodeString? - c++

Question

I tried to write an injector but using LdrLoadDll instead of LoadLibrary.
However, I am unable to assign PUNICODE_STRING. the compiler shows Error C2326 'main :: _ params :: _ params (void)': function cannot access 'dllName' But why
If you replace LdrLoadDll and its definition with Beep (kernel32.dll) and, the "params" structure, then everything works and the sound appears
#include <windows.h>
#include <winternl.h>
#pragma comment(lib, "ntdll.lib")
using namespace std;
EXTERN_C NTSYSAPI NTSTATUS NTAPI NtCreateThreadEx(PHANDLE,
ACCESS_MASK, LPVOID, HANDLE, LPVOID, LPVOID,
BOOL, SIZE_T, SIZE_T, SIZE_T, LPVOID);
typedef HMODULE(__stdcall* _LdrLoadDll)(
wchar_t* PathToFile,
unsigned long Flags,
PUNICODE_STRING ModuleFileName,
PHANDLE* ModuleHandle
);
int main()
{
DWORD targetProcId =212;
HANDLE targetOpened = OpenProcess(PROCESS_ALL_ACCESS, FALSE, targetProcId);
_LdrLoadDll LdrLoadDll = (_LdrLoadDll)GetProcAddress(GetModuleHandleA("ntdll.dll"), "LdrLoadDll");
UNICODE_STRING dllName;
dllName.Buffer = (wchar_t*)L"DllTest32.dll";
dllName.Length = wcslen(dllName.Buffer) * sizeof(wchar_t);
dllName.MaximumLength = dllName.Length + sizeof(wchar_t);
static struct _params {
wchar_t* PathToFile = (wchar_t*)L"C:\\DllTest32.dll";
unsigned long Flags = 0;
PUNICODE_STRING ModuleFileName = &dllName; //something wrong here — Error C2326 'main::_params::_params(void)': function cannot access 'dllName'
PHANDLE* ModuleHandle = 0;
} params;
HANDLE rt;
NtCreateThreadEx(
&rt, PROCESS_CREATE_THREAD, NULL, targetOpened,
LdrLoadDll,
&params,
FALSE, NULL, NULL, NULL, NULL);
}

Answer 1

A local class cannot access non-static variables of the enclosing function.
To fix, you need to access dllName outside of the class:
static struct _params {
wchar_t* PathToFile = (wchar_t*)L"C:\\DllTest32.dll";
unsigned long Flags = 0;
PUNICODE_STRING ModuleFileName;
PHANDLE* ModuleHandle = 0;
} params;
params.ModuleFileName = &dllName;