NtReadFile doesn't read - c++

Question

I try to write dll injector with nativeApi. My first question is this good way to do it?
And second is: NtReadFile doesn't fail, but also doesn't read. I think it's buffer wrong but i'm not sure? How can i fix this issue?
Now it's look like this:
bool initiationDll(const std::string& dllPath){
if (!isDllExist(dllPath))
{
printf("Dll doesn't exist!\n");
return false;
}
else
{
printf("LibraryPath :%s\n", dllPath.c_str());
NTSTATUS status;
HANDLE lFile;
OBJECT_ATTRIBUTES objAttribs = { 0 };
UNICODE_STRING unicodeString;
std::string dllPathWithprefix = "\\??\\" + dllPath;
std::wstring wString = std::wstring(dllPathWithprefix.begin(), dllPathWithprefix.end()); PCWSTR toPcwstr = wString.c_str();
RtlInitUnicodeString(&unicodeString, toPcwstr);
InitializeObjectAttributes(&objAttribs, &unicodeString, OBJ_CASE_INSENSITIVE, NULL, NULL);
objAttribs.Attributes = 0;
const int allocSize = 2048;
LARGE_INTEGER largeInteger;
largeInteger.QuadPart = allocSize;
IO_STATUS_BLOCK ioStatusBlock;
status = NtCreateFile(
&lFile,
GENERIC_ALL,
&objAttribs,
&ioStatusBlock,
&largeInteger,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ,
FILE_OPEN,
FILE_NON_DIRECTORY_FILE,
NULL,
NULL
);
if (!NT_SUCCESS(status)) {
printf("CreateFile failed..\n");
return false;
}
else {
printf("Library Handle : %p\n", lFile);
DWORD fileSize = getDllSize(dllPath);
if (fileSize == 0)
{
printf("File size 0.\n");
return false;
}
else
{
printf("File size : %d byte.\n", fileSize);
PVOID FileReadBuffer;
FileReadBuffer = new CHAR[fileSize];
status = NtReadFile(
lFile,
NULL,
NULL,
NULL,
&ioStatusBlock,
FileReadBuffer,
sizeof(FileReadBuffer),
0, // ByteOffset
NULL);
if (!NT_SUCCESS(status))
{
printf("Unable to read the dll... : %d\n", GetLastError());
return false;
}
}
}}
For NtCreateFile :
status -> 0
ioStatusBlock : Status -> 0
Pointer -> 0x00000000
Information -> 1
I try NtOpenFile and same result.
For NtReadFile :
status -> -1073741811
ioStatusBlock : Status -> 0
Pointer -> 0x00000000
Information -> 1
Result values right after NtCreateFile function
Result values right after NtReadFile function

Answer 1

if (lFile == INVALID_HANDLE_VALUE) -
you need check status returned but not lFile and NT never set file handle to INVALID_HANDLE_VALUE - so condition always will be FALSE. OPEN_EXISTING (3) - wrong constant to NtCreateFile - need use FILE_OPEN(1) for example or use NtOpenFile. you open file as asynchronous (no FILE_SYNCHRONOUS_IO_NONALERT or FILE_SYNCHRONOUS_IO_NALERT ) - so faster of all you got STATUS_PENDING (0x103) as result of NtReadFile. so you not enter to if (!NT_SUCCESS(status)) block for STATUS_PENDING but data yet not ready in FileReadBuffer.
and next time post all status and ioStatusBlock values

Answer 2

The status code -1073741811 from NtReadFile means you passed an INVALID_PARAMETER.
ErrorCodeDescription
Assigning 0 to the ByteOffset parameter fixed the Problem for me;
LARGE_INTEGER liBytes = { 0 };
status = SysNtReadFile(pFileHandle, NULL, NULL, NULL, &statusBlock, buffer, fileSize, &liBytes, NULL);