Search code examples
c#pinvokeapimonitor

Reading from buffer shows unrecognizable (Chinese) characters


I am doing a P/Invoke on Ntdll.dll!NtWriteFile and while reading the Buffer (PVOID), I'm getting unrecognizable characters. I tried different encoding with no change. I'm also monitoring the process using API Monitor from Rohitab so I see the correct value I'm trying to retrieve. Anyone run into this issue?

NtWriteFile(
  IN HANDLE  FileHandle,
  IN HANDLE  Event OPTIONAL,
  IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
  IN PVOID ApcContext OPTIONAL,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  IN PVOID Buffer,
  IN ULONG Length,
  IN PLARGE_INTEGER ByteOffset OPTIONAL,
  IN PULONG  Key OPTIONAL );

Example of output:

笍^稌ƭ덾塾畿浽ꭼɿݾ浼굺ꥻꥻ Āጀ‘℀

萰퓶픊茚 缊<縌੾葿繾륿뙾孿퍿Ϳ큾靾≿≿

缊f縌ϲ橿⹿筿偿᱿㽿ꅿ왿ѿ豿豿 笍^稌ƭ덾塾畿浽ꭼɿݾ浼굺ꥻꥻ 缊<縌੾葿繾륿뙾孿퍿Ϳ큾靾≿≿ 缊f縌ϲ橿⹿筿偿᱿㽿ꅿ왿ѿ豿豿 缷舆ⴀᣢ


Solution

  • I was able to encode the text by using the below.

    Byte[] bytes = Encoding.Unicode.GetBytes(p);
    var bUTF8 = Encoding.UTF8.GetString(bytes);