Using DeviceIoControl from C# code always returns empty output buffer

Question

I have a driver, which I want to use from my C# client app. The issue here is that my output buffer is always empty (0). When I use this driver from C code - everything works like a charm, so I think the issue is in my client C# code.

Extern is defined as below:

    [DllImport(kernel, EntryPoint = "DeviceIoControl", SetLastError = true, CharSet = CharSet.Auto)]
    [return: MarshalAs(UnmanagedType.Bool)]
    public static extern bool DeviceIoControl(
        SafeFileHandle hDevice,
        UInt32 dwIoControlCode,
        IntPtr lpInBuffer,
        UInt32 nInBufferSize,
        IntPtr lpOutBuffer,
        UInt32 nOutBufferSize,
        ref UInt32 lpBytesReturned,
        [In] ref NativeOverlapped lpOverlapped);

And I am using it as:

    public static T ReadVirtualMemory<T>(SafeFileHandle driverHandle, int offset) where T : unmanaged
    {
        var inBuffer = (object)new T();
        var nInBufferSize = Marshal.SizeOf(typeof(T));

        var outBuffer = (object)new T();
        var nOutBufferSize = Marshal.SizeOf(typeof(T));

        var data = new KERNEL_READ_REQUEST
        {
            Address = (ulong)offset,
            Size = (ulong)nInBufferSize,
            pBuffer = (IntPtr)inBuffer
        };

        IntPtr lpInBuffer = IntPtr.Zero;
        IntPtr lpOutBuffer = IntPtr.Zero;

        nInBufferSize = Marshal.SizeOf(data);
        lpInBuffer = Marshal.AllocHGlobal(nInBufferSize);
        Marshal.StructureToPtr(data, lpInBuffer, true);

        lpOutBuffer = Marshal.AllocHGlobal(nOutBufferSize);
        Marshal.StructureToPtr(outBuffer, lpOutBuffer, true);

        UInt32 lpBytesReturned = 0;
        NativeOverlapped lpOverlapped = new NativeOverlapped();

        Kernel32.DeviceIoControl(
            driverHandle,
            (uint)DriverMethod.ReadMemory,
            lpInBuffer,
            (uint)nInBufferSize,
            lpOutBuffer,
            (uint)nOutBufferSize,
            ref lpBytesReturned,
            ref lpOverlapped);

        outBuffer = (T)Marshal.PtrToStructure(lpOutBuffer, typeof(T));

        return lpBytesReturned == nOutBufferSize ? (T)outBuffer : default;
    }

I am not sure why, bytes returned = 8, though it should be 4. And as I've said - out buffer is empty. Drver's code:

    PKERNEL_READ_REQUEST readRequest = (PKERNEL_READ_REQUEST)pIrp->AssociatedIrp.SystemBuffer;
    PEPROCESS process;

    if (NT_SUCCESS(PsLookupProcessByProcessId(ProcessId, &process)))
    {
        DebugMessage("ReadRequest requested\n");

        KernelReadVirtualMemory(process, readRequest->Address, readRequest->pBuffer, readRequest->Size);

        byteIo = sizeof(PKERNEL_READ_REQUEST);
        status = STATUS_SUCCESS;
    }

and

    NTSTATUS NTAPI MmCopyVirtualMemory
    (
        PEPROCESS SourceProcess,
        PVOID SourceAddress,
        PEPROCESS TargetProcess,
        PVOID TargetAddress,
        SIZE_T BufferSize,
        KPROCESSOR_MODE PreviousMode,
        PSIZE_T ReturnSize
    );

    NTSTATUS KernelReadVirtualMemory(PEPROCESS process, PVOID sourceAddress, PVOID targetAddress, SIZE_T size)
    {
        PSIZE_T bytes;

        return MmCopyVirtualMemory(process, sourceAddress, PsGetCurrentProcess(), targetAddress, size, KernelMode, &bytes);
    }

Probably this is smth about structure alignment, but I am not sure (In C client app sizeof structure is 18 bytes, in C# 32 bytes).

Please advise

Answer 1

First - I had to compile in x64. Second - had to allocate memory for pBuffer

Below is a working example

        var nInBufferSize = Marshal.SizeOf(typeof(T));
        var inBuffer = Marshal.AllocHGlobal(nInBufferSize);

        var data = new KERNEL_READ_REQUEST
        {
            Address = offset,
            Size = nInBufferSize,
            pBuffer = inBuffer
        };

        var requestSize = Marshal.SizeOf(data);
        var requestBuffer = Marshal.AllocHGlobal(requestSize);
        Marshal.StructureToPtr(data, requestBuffer, true);

        uint bytesReturned = 0;
        var overlapped = new NativeOverlapped();

        Kernel32.DeviceIoControl(
            driverHandle,
            (uint)DriverMethod.ReadMemory,
            requestBuffer,
            (uint)requestSize,
            requestBuffer,
            (uint)requestSize,
            ref bytesReturned,
            ref overlapped);

        var result = Marshal.PtrToStructure(data.pBuffer, typeof(T));

        return (T?)result ?? default;