C++ WriteFile only writing 4 bytes

Question

Here's what I'm trying to achieve; I'm hooking onto the HttpSendRequest function (on Xbox it's XHttp) and trying dump the certificate that's in pcszHeaders which has the size of 0x1F0E.

Now the problem; it only seems to write 4 bytes, I've even tried allocating extra memory and setting each bit to 0 to see if it's the size of Headers and it continues to only write 4 bytes. I've been able to dump pcszHeaders remotely because I got the address whilst debugging but I need to dump it at run-time.

Something I notice whilst debugging - The address of pcszHeaders only shows in locals until it reaches;

 printf("XHttpSendRequest: %s\n", "Creating Certificate.bin...");

Once it reaches the printf() above the address changes to 0x00000000 (bad ptr) but it still writes the first byte of correct data of pcszHeaders correctly but nothing more.

Here is the entire hook;

BOOL XHTTP_SEND_REQUEST_HOOK(
     HINTERNET hRequest,
     const CHAR *pcszHeaders,
     DWORD dwHeadersLength,
     const VOID *lpOptional,
     DWORD dwOptionalLength,
     DWORD dwTotalLength,
     DWORD_PTR dwContext)
{

  if(pcszHeaders != XHTTP_NO_ADDITIONAL_HEADERS)
  {

 printf("XHttpSendRequest: %s\n", "Creating Certificate.bin...");

  // Setup expansion 
 doMountPath("Hdd:", "\\Device\\Harddisk0\\Partition1");    

 //create our file
 HANDLE fileHandle = CreateFile("Hdd:\\Certificate.bin", GENERIC_WRITE, FILE_SHARE_WRITE, NULL, CREATE_NEW, FILE_ATTRIBUTE_NORMAL, NULL);

 //does file exist?
 if(GetLastError()!=ERROR_ALREADY_EXISTS
     ||fileHandle!=INVALID_HANDLE_VALUE)
 {
     printf("XHttpSendRequest: %s\n", "Writing to file...");

     DWORD wfbr;

     //write to our file
     if(WriteFile(fileHandle, pcszHeaders, 0x2000, &wfbr, NULL))
     {
         printf("XHttpSendRequest: %s\n", "File written!");
         printf("%s\n", "Request has ended.");

         CloseHandle(fileHandle);
         return XHttpSendRequest(hRequest, pcszHeaders, dwHeadersLength, lpOptional, dwOptionalLength, dwTotalLength, dwContext);
      }
    }
  }
}

EDIT: I've changed the code slightly and I've copied pcszHeaders data into another section of memory that I've created and my pointers seems to have all the correct data and I've tried Writing it to file and it still only writes 4 bytes. I've even used sizeof() instead of hard-coded 0x2000.

Answer 1

pcszHeaders is a char* pointer. sizeof(pcszHeaders) is 4 in a 32bit app (8 in a 64bit app). You need to use the dwHeadersLength parameter instead, which tells you how many characters are in pcszHeaders.

Also, your GetLastError() check after CreateFile() is wrong. If CreateFile() fails for any reason other than ERROR_ALREADY_EXISTS, you are entering the code block and thus writing data to an invalid file handle. When using CREATE_NEW, CreateFile() returns INVALID_HANDLE_VALUE if the file already exists. You don't need to check GetLastError() for that, checking for INVALID_HANDLE_VALUE by itself is enough. If you want to overwrite the existing file, use CREATE_ALWAYS instead.

You are also leaking the file handle if WriteFile() fails.

And you are calling the original HttpSendRequest() only if you successfully write headers to your file. If there are no headers, or the create/write fails, you are not allowing the request to proceed. Is that what you really want?

Try this instead:

BOOL XHTTP_SEND_REQUEST_HOOK(
     HINTERNET hRequest,
     const CHAR *pcszHeaders,
     DWORD dwHeadersLength,
     const VOID *lpOptional,
     DWORD dwOptionalLength,
     DWORD dwTotalLength,
     DWORD_PTR dwContext)
{
    if (pcszHeaders != XHTTP_NO_ADDITIONAL_HEADERS)
    {
        printf("XHttpSendRequest: Creating Certificate.bin...\n");

        // Setup expansion 
        doMountPath("Hdd:", "\\Device\\Harddisk0\\Partition1");    

        //create our file
        HANDLE fileHandle = CreateFile("Hdd:\\Certificate.bin", GENERIC_WRITE, FILE_SHARE_WRITE, NULL, CREATE_NEW, FILE_ATTRIBUTE_NORMAL, NULL);

        //is file open?
        if (fileHandle != INVALID_HANDLE_VALUE)
        {
            printf("XHttpSendRequest: Writing to file...\n");

            DWORD wfbr;

            //write to our file
            if (WriteFile(fileHandle, pcszHeaders, dwHeadersLength, &wfbr, NULL))
                printf("XHttpSendRequest: File written!\n");
            else
                printf("XHttpSendRequest: Error writing to file: %u\n", GetLastError());

            CloseHandle(fileHandle);
        }
        else
            printf("XHttpSendRequest: Error creating file: %u\n", GetLastError());
    }

    printf("Request has ended.\n");
    return XHttpSendRequest(hRequest, pcszHeaders, dwHeadersLength, lpOptional, dwOptionalLength, dwTotalLength, dwContext);
}

Answer 2

Finally the problem has been solved!

First I created an empty array for the data to be stored.

CHAR xtoken[0x2000];
memset(xtoken, 0, 0x2000);

The first part of the hook is to store the header data.

DWORD bufferLength = dwHeadersLength;
memcpy(xtoken, pcszHeaders, bufferLength);

I then write the data to file

WriteFile(fileHandle, (void*)&xtoken, bufferLength, &wfbr, NULL))

Success! I guess the problem was that parameter 2 of WriteFile() was incorrect.