AuditQuerySystemPolicy() 函数针对“安全状态更改”抛出 AccessViolationException。

Question

我正在开发一个程序，该程序将编译有关本地系统审核策略的信息。这是我的代码：

    [DllImport("advapi32.dll", SetLastError = true)]
    public static extern bool AuditQuerySystemPolicy(
        Guid pSubCategoryGuids,
        uint PolicyCount,
        out IntPtr ppAuditPolicy
    );

    ...

    void getSubCategories(AuditPolicyCategory category, long guidSize) {
        IntPtr ppAuditSubCategoriesArray = IntPtr.Zero;
        uint pCountReturned = 0;
        Guid catGuid = category.CategoryGuid;
        bool result = AuditEnumerateSubCategories(ref catGuid, false, out ppAuditSubCategoriesArray, out pCountReturned);
        if (!result) {
            throw new Exception($"[AuditPolicyCategory::getSubCategories] {new Win32Exception(Marshal.GetLastWin32Error()).Message}");
        }
        long ptr = (long)ppAuditSubCategoriesArray;
        for (int i = 0; i < pCountReturned; i++) {
            var guid = (Guid)Marshal.PtrToStructure((IntPtr)ptr, typeof(Guid));
            string name = getSubCategoryName(guid);
            Console.WriteLine($"Current subcategory: {name}");
            AuditType state = getPolicyStatus(guid);
            //do something with the result
            ptr += guidSize;
        }
        AuditFree(ppAuditSubCategoriesArray);
    }

当以下方法调用 AuditQuerySystemPolicy() 函数时，会引发异常。无论 catGuid 的值如何，它都会抛出 AccessViolationException：

    AuditType getPolicyStatus(Guid guid) {
        IntPtr ppAuditPolicy = IntPtr.Zero;
        bool result = AuditQuerySystemPolicy(guid, 1, out ppAuditPolicy);
        if (!result) {
            throw new Exception($"[AuditPolicyCategory::getPolicyStatus] {new Win32Exception(Marshal.GetLastWin32Error()).Message}");
        }
        if (IntPtr.Zero.Equals(ppAuditPolicy)) {
            throw new Exception($"[AuditPolicyCategory::getPolicyStatus] invalid audit policy returned");
        }
    
        //do something with the result
    }

我已尝试在管理上下文中运行该程序，并且还向我的帐户授予了 Manage审计和安全日志用户权限分配。不知道接下来该去哪里。

提前致谢！

Answer 1

我需要将目标平台从 Any CPU 更改为 x64 以逃避 .NET 沙箱