Windows API Error "The handle is invalid"

Question

I'm trying to create a program that utilises the MiniDumpWriteDump Windows API to dump another process's memory. However, it keeps returning an error saying The handle is invalid. I'm pretty confident in my process handle because I've used the OpenProcess Windows API before, so I think it's how I'm using CreateFileW.

I have looked at examples online like this one but I can't get anything working.

Here is my code so far:

package main

import (
    "fmt"
    "os"
    "strconv"
    "syscall"
    "unsafe"
)

var kernel32        = syscall.NewLazyDLL("kernel32.dll")
var procOpenProcess = kernel32.NewProc("OpenProcess")
var procCreateFileW = kernel32.NewProc("CreateFileW")
var procCloseHandle = kernel32.NewProc("CloseHandle")

var dbghelp               = syscall.NewLazyDLL("Dbghelp.dll")
var procMiniDumpWriteDump = dbghelp.NewProc("MiniDumpWriteDump")

func main() {
    fmt.Println("[ ] Starting Enum-DumpProcessMemory\n")

    pid, _ := strconv.Atoi(os.Args[1])
    fmt.Println("[-] PID            :", pid)

    processHandle, _, _ := procOpenProcess.Call(uintptr(0xFFFF), uintptr(1), uintptr(pid))
    fmt.Println("[-] Process Handle :", processHandle)

    path, _ := syscall.UTF16PtrFromString(os.Args[2])
    fileHandle, _, _ := procCreateFileW.Call(uintptr(unsafe.Pointer(path)), syscall.GENERIC_READ, syscall.FILE_SHARE_READ|syscall.FILE_SHARE_WRITE, 0, syscall.OPEN_EXISTING, syscall.FILE_ATTRIBUTE_NORMAL, 0)
    fmt.Println("[-] File Handle    :", fileHandle)

    ret, _, err := procMiniDumpWriteDump.Call(uintptr(processHandle), uintptr(pid), uintptr(fileHandle), 0x00061907, 0, 0, 0)

    if ret != 0 {
        fmt.Println("[+] Process memory dump successful")
    } else {
        fmt.Println("[x] Process memory dump not successful")
        fmt.Println(err)
    }
}

Here is the output:

> .\Enum-DumpProcessMemory.exe 6892 C:\Users\user\Documents\dump.dmp
[ ] Starting Enum-DumpProcessMemory

[-] PID            : 6892
[-] Process Handle : 236
[-] File Handle    : 18446744073709551615
[x] Process memory dump not successful
The handle is invalid.

Which handle is invalid? What function is failing? What error code does GetLastError() return? — Jonathan Potter
It doesn't say which error is invalid, however, I think it's the file handle. The MiniDumpWriteDump process is failing. GetLastError() returns 0. — TimeLoad
The way to find out which handle is invalid is to check for errors. — Jonathan Potter
Thanks for the help. I did a little more debugging and realised my problem. — TimeLoad

TimeLoad TimeLoad · Accepted Answer · 2019-07-18T04:50:44

I got the code working thanks to the help from Jonathan Potter. The problem was that I was trying to create a handler to a file that didn't exist.

Here is my working code:

package main

import (
    "fmt"
    "os"
    "strconv"
    "syscall"
    "unsafe"
)

var kernel32        = syscall.NewLazyDLL("kernel32.dll")
var procOpenProcess = kernel32.NewProc("OpenProcess")
var procCreateFileW = kernel32.NewProc("CreateFileW")

var dbghelp               = syscall.NewLazyDLL("Dbghelp.dll")
var procMiniDumpWriteDump = dbghelp.NewProc("MiniDumpWriteDump")

func main() {
    fmt.Println("[ ] Starting Enum-DumpProcessMemory\n")

    pid, _ := strconv.Atoi(os.Args[1])
    fmt.Println("[-] PID            :", pid)

    processHandle, _, _ := procOpenProcess.Call(uintptr(0xFFFF), uintptr(1), uintptr(pid))
    fmt.Println("[-] Process Handle :", processHandle)

    if _, err := os.Stat(os.Args[2]); os.IsNotExist(err) {
        os.Create(os.Args[2])
    }
    path, _ := syscall.UTF16PtrFromString(os.Args[2])

    fileHandle, _, _ := procCreateFileW.Call(uintptr(unsafe.Pointer(path)), syscall.GENERIC_WRITE, syscall.FILE_SHARE_READ|syscall.FILE_SHARE_WRITE, 0, syscall.OPEN_EXISTING, syscall.FILE_ATTRIBUTE_NORMAL, 0)
    fmt.Println("[-] File Handle    :", fileHandle)

    ret, _, err := procMiniDumpWriteDump.Call(uintptr(processHandle), uintptr(pid), uintptr(fileHandle), 0x00061907, 0, 0, 0)

    if ret != 0 {
        fmt.Println("[+] Process memory dump successful")
    } else {
        fmt.Println("[x] Process memory dump not successful")
        fmt.Println(err)
    }
}

Windows API Error "The handle is invalid"

1 Answers