ConvertLUnicodeStringToNullTerminatedString

//----- (00000001800B5360) ----------------------------------------------------__int64 __fastcall `anonymous namespace'::ConvertLUnicodeStringToNullTerminatedString(unsigned __int64 *a1, void **a2){  void **v2; // rsi@1  unsigned __int64 v3; // rdi@1  unsigned __int64 *v4; // rbx@1  const void *v5; // rdx@1  __int64 v6; // rax@3  const void *v7; // rdx@3  signed int v8; // ebx@4  const void *v9; // rdx@5  size_t v10; // rdi@5  char *v11; // rbx@5  const void *v12; // rdx@5  const char *v14; // [sp+20h] [bp-40h]@4  const char *v15; // [sp+28h] [bp-38h]@4  int v16; // [sp+30h] [bp-30h]@4  const char *v17; // [sp+38h] [bp-28h]@4  int v18; // [sp+40h] [bp-20h]@4  void *Dst; // [sp+48h] [bp-18h]@3  v2 = a2;  v3 = *a1 >> 1;  v4 = a1;  v5 = (const void *)(v3 + 1);  if ( v3 + 1 < v3 || (unsigned __int64)v5 < 1 )  {    v8 = -2147024362;    v18 = -2147024362;    Windows::ErrorHandling::COM::CBaseFrame<Windows::ErrorHandling::COM::CVoidRaiseFrame>::ReportErrorPropagation(&v18);  }  else  {    Dst = 0i64;    LODWORD(v6) = Windows::AutoNullTerminatedString<Windows::COM::CLPWSTRTraits,Windows::Auto<unsigned short *>>::ResizeBufferNoPreserve(                    (Windows::COM **)&Dst,                    v5);    if ( v6 )    {      v9 = (const void *)v4[2];      v10 = 2 * v3;      v11 = (char *)Dst;      memcpy_0(Dst, v9, v10);      *(_WORD *)&v11[v10] = 0;      Dst = *v2;      *v2 = v11;      Windows::AutoPointerBase<unsigned short const *,Windows::Auto<unsigned short const *>>::Close(        (Windows::COM **)&Dst,        v12);      return 0i64;    }    v8 = -2147024882;    v18 = -2147024882;    Windows::AutoPointerBase<unsigned short const *,Windows::Auto<unsigned short const *>>::Close(      (Windows::COM **)&Dst,      v7);    v16 = 2006;    v14 = "base\\wcp\\dll\\createwin.cpp";    v15 = "`anonymous-namespace'::ConvertLUnicodeStringToNullTerminatedString";    v17 = "pszTemp.ResizeBufferNoPreserve(cchTotal)";    Windows::ErrorHandling::COM::CBaseFrame<Windows::ErrorHandling::COM::CSimpleHResultCarryingFrame>::ReportErrorOrigination(      &v18,      (Windows::ErrorHandling::COM *)&v14);  }  return (unsigned int)v8;}调用Set_g_pIMalloc();LUNICODE_STRING name0;RtlInitLUnicodeString(&name0, L"C:\\windows\\explorer.exe");WCHAR *name2 = L"";WCHAR** name3 = &name2;ConvertLUnicodeStringToNullTerminatedString(&name0, name3);printf("%ws\n", *name3);Critical error detected c0000374堆被破坏。

因此，在调用前对返回参数用 CoTaskMemAlloc 进行重新分配一下，就可以了。

*a2 = (WCHAR*)CoTaskMemAlloc(0);UINT_PTR result = g_fnConvertLUnicodeStringToNullTerminatedString(a1, a2);