microsoft / etl2pcapng

Utility that converts an .etl file containing a Windows network packet capture into .pcapng format.
MIT License
607 stars 114 forks source link

WriteFile to fail is that you are passing NULL as the fourth parameter, which is not allowed for older Windows vision. #78

Open mkurkute opened 3 months ago

mkurkute commented 3 months ago

Please check the link.

4th parameter (lpNumberOfBytesWritten) is expecting pointer to DWORD value when you pass NULL to that parameter it attempts to write DWORD to null pointer which causes exception.

To fix this problem, you need to declare a DWORD variable and pass its address as the fourth parameter, like this:

DWORD at; iWriteFile(File, WriteBuf, WriteBufNext, &at, NULL)

This way, you can also check the value of 'at' after the function returns to see if it matches the expected number of bytes.