ept_map MSRPC EPT 调用问题-看雪学苑-看雪-安全培训|安全招聘|www.kanxue.com

ept_map MSRPC EPT 调用问题

wx_1_842 2022-12-22 1265

严重性代码说明项目文件行禁止显示状态
错误 LNK1120 1 个无法解析的外部命令 ConsoleApplication1 C:\Users\1\Desktop\ConsoleApplication1\Debug\ConsoleApplication1.exe 1
改成0提示占位空指针

3条回答

wx_1_842 2022-12-30

列子有没有

wx_1_842 2022-12-30

https://bbs.125.la/forum.php?mod=viewthread&tid=14758535&extra=

/* file: helloc.c */
#include <stdlib.h>
#include <stdio.h>
#include <ctype.h>
#include "WMRPC_h.h"
#include <windows.h>
#include <iostream>

#pragma comment(lib, "Rpcrt4.lib")

int main()
{
    UUID A;
    UuidFromStringA((RPC_CSTR)"e1af8308-5d1f-11c9-91a4-08002b14a0fa",&A);
    //RPC_BINDING_HANDLE_TEMPLATE_V1_A TEMPLATE_V1_A = {1,RPC_BHT_OBJECT_UUID_VALID,RPC_PROTSEQ_TCP ,(PUCHAR)"\\192.168.230.128\\epmapper",NULL,NULL,A};
    //RPC_BINDING_HANDLE H;
    //RPC_BINDING_HANDLE_SECURITY_V1_A SECURITY_V1_A = {1};

//RpcBindingCreateA(&TEMPLATE_V1_A,&SECURITY_V1_A,NULL,&H);
    //
    //RPC_IF_HANDLE Proc3_ept_map = {};
    RPC_BINDING_HANDLE BindingHandle;
    //printf("%X",RpcBindingBind(NULL, H, Proc3_ept_map));

RPC_STATUS status;
    RPC_WSTR pszUuid = (RPC_WSTR)L"E1AF8308-5D1F-11C9-91A4-08002B14A0FA";
    RPC_WSTR pszProtocolSequence = (RPC_WSTR)L"ncacn_np";
    RPC_WSTR pszNetworkAddress = (RPC_WSTR)L"\\192.168.2.5\\epmapper";
    RPC_WSTR pszEndpoint = (RPC_WSTR)L"\\pipe\\epmapper";
    RPC_WSTR pszOptions = NULL;
    RPC_WSTR pszStringBinding = NULL;
    RPC_WSTR pszString = (RPC_WSTR)L"hello, world";
    unsigned long ulCode;

status = RpcStringBindingComposeW(pszUuid,
        pszProtocolSequence,
        pszNetworkAddress,
        pszEndpoint,
        pszOptions,
        &pszStringBinding);
    if (status) exit(status);

//Struct_12_t A = { /*4264640272 ,2046 ,NULL,(BYTE)"\x30\x12\x2E\xFE\xFE\x07\x00"*/};
    status = RpcBindingFromStringBindingW(pszStringBinding, &BindingHandle);
    twr_t T = {75,5};
            error_status_t error_status_t;
            ept_lookup_handle_t ept_lookup_handle_t;
            unsigned32 U;
            twr_p_t twr_p_t=&T;
    if (status) exit(status);

RpcTryExcept
            {
                //PVOID QA;
                //PVOID P;
                //Struct_88_t * AQ;

ept_map(BindingHandle,NULL,&T, NULL,100, &U, &twr_p_t, &error_status_t);
    }
        RpcExcept(1)
    {
        ulCode = RpcExceptionCode();
        printf("Runtime reported exception 0x%lx = %ld\n", ulCode, ulCode);
    }
    RpcEndExcept

status = RpcStringFree(&pszStringBinding);

if (status) exit(status);

status = RpcBindingFree(&BindingHandle);

if (status) exit(status);
    printf("%X", error_status_t);
    exit(0);
}

/******************************************************/
/*         MIDL allocate and free                     */
/******************************************************/

void __RPC_FAR* __RPC_USER midl_user_allocate(size_t len)
{
    return(malloc(len));
}

void __RPC_USER midl_user_free(void __RPC_FAR* ptr)
{
    free(ptr);
}

wx_1_842 2022-12-30

/ file: helloc.c /

#include <stdlib.h>

#include <stdio.h>

#include <ctype.h>

#include "WMRPC_h.h"

#include <windows.h>

#include <iostream>

#pragma comment(lib, "Rpcrt4.lib")

int main()
{
UUID A;
UuidFromStringA((RPC_CSTR)"e1af8308-5d1f-11c9-91a4-08002b14a0fa",&A);
//RPC_BINDING_HANDLE_TEMPLATE_V1_A TEMPLATE_V1_A = {1,RPC_BHT_OBJECT_UUID_VALID,RPC_PROTSEQ_TCP ,(PUCHAR)"\192.168.230.128\epmapper",NULL,NULL,A};
//RPC_BINDING_HANDLE H;
//RPC_BINDING_HANDLE_SECURITY_V1_A SECURITY_V1_A = {1};

//RpcBindingCreateA(&TEMPLATE_V1_A,&SECURITY_V1_A,NULL,&H);
//
//RPC_IF_HANDLE Proc3_ept_map = {};
RPC_BINDING_HANDLE BindingHandle;
//printf("%X",RpcBindingBind(NULL, H, Proc3_ept_map));
 
RPC_STATUS status;
RPC_WSTR pszUuid = (RPC_WSTR)L"E1AF8308-5D1F-11C9-91A4-08002B14A0FA";
RPC_WSTR pszProtocolSequence = (RPC_WSTR)L"ncacn_np";
RPC_WSTR pszNetworkAddress = (RPC_WSTR)L"\\192.168.2.5\\epmapper";
RPC_WSTR pszEndpoint = (RPC_WSTR)L"\\pipe\\epmapper";
RPC_WSTR pszOptions = NULL;
RPC_WSTR pszStringBinding = NULL;
RPC_WSTR pszString = (RPC_WSTR)L"hello, world";
unsigned long ulCode;
 
status = RpcStringBindingComposeW(pszUuid,
    pszProtocolSequence,
    pszNetworkAddress,
    pszEndpoint,
    pszOptions,
    &pszStringBinding);
if (status) exit(status);
 
//Struct_12_t A = { /*4264640272 ,2046 ,NULL,(BYTE)"\x30\x12\x2E\xFE\xFE\x07\x00"*/};
status = RpcBindingFromStringBindingW(pszStringBinding, &BindingHandle);
twr_t T = {75,5};
        error_status_t error_status_t;
        ept_lookup_handle_t ept_lookup_handle_t;
        unsigned32 U;
        twr_p_t twr_p_t=&T;
if (status) exit(status);
 
        RpcTryExcept
        {
            //PVOID QA;
            //PVOID P;
            //Struct_88_t * AQ;
 
    ept_map(BindingHandle,NULL,&T, NULL,100, &U, &twr_p_t, &error_status_t);
}
    RpcExcept(1)
{
    ulCode = RpcExceptionCode();
    printf("Runtime reported exception 0x%lx = %ld\n", ulCode, ulCode);
}
RpcEndExcept
 
    status = RpcStringFree(&pszStringBinding);
 
if (status) exit(status);
 
status = RpcBindingFree(&BindingHandle);
 
if (status) exit(status);
printf("%X", error_status_t);
exit(0);