Creating string of hashes from PVOID variable

[Airick73]

I was trying to find a way to create a string of hashes from a PVOID variable in a for loop. For reference I have the following code

resultTempList->Items[i] is a PVOID*
jsonString is a PHH_STRING.

Inside the MDCBuildJsonArray function I want to retrieve the hash from resultTempList->Items[i] and concatenate it to jsonString. Note I am able to successfully retrieve the hash with the following method.

My problem is finding a good function within Process Hacker that successfully concatenate a string. I've tried the functions such as PPH_STRING PhConcatStrings2( _In_ PWSTR String1, _In_ PWSTR String2 ) and PPH_STRING PhConcatStringRef2( _In_ PPH_STRINGREF String1, _In_ PPH_STRINGREF String2 ) but they seem to lead to errors which lead to no where for me such as Ntdll.dll. If anyone has experience with concatenating strings from different objects within Process Hacker and can share insight I would greatly appreciate it.

[Advait251206]

The string concatenation functions themselves may not be the problem here. Looking at the code snippet, I'd first verify that the types being passed around are what the Process Hacker string APIs expect.

A few observations:

1. PhConcatStrings2 returns a new string

Functions such as:

PPH_STRING PhConcatStrings2(
    _In_ PWSTR String1,
    _In_ PWSTR String2
);

don't append to an existing PPH_STRING; they allocate and return a new one.

For example:

PPH_STRING newString = PhConcatStrings2(
    jsonString->Buffer,
    hashString->Buffer
);

You would then need to manage the references correctly:

PhDereferenceObject(jsonString);
jsonString = newString;

If you ignore the returned value, nothing is actually appended.

2. Watch out for ownership/reference counting

Most PPH_STRING objects are reference-counted. If you're repeatedly concatenating strings inside a loop, you'll want to dereference temporary strings to avoid leaks.

Something like:

PPH_STRING temp;

temp = PhConcatStrings2(
    jsonString->Buffer,
    hashString->Buffer
);

PhDereferenceObject(jsonString);
jsonString = temp;

3. Consider using a string builder

If you're building a large JSON string in a loop, repeatedly concatenating strings can become inefficient because every concatenation allocates a new buffer.

Process Hacker has string builder APIs that are generally better suited for this pattern. Depending on the version you're working with, look for structures/functions related to:

PH_STRING_BUILDER

and operations such as:

PhInitializeStringBuilder(...)
PhAppendStringBuilder(...)
PhAppendFormatStringBuilder(...)

Building the JSON incrementally is usually much cleaner than repeated concatenation.

4. Verify the cast from PVOID

You mention:

resultTempList->Items[i]

is a PVOID *, while your function expects:

PMDC_FILE_HASH_ENTRY Entry

Make sure the stored object really is a PMDC_FILE_HASH_ENTRY before passing it in:

MDCBuildJsonArray(
    (PMDC_FILE_HASH_ENTRY)resultTempList->Items[i],
    jsonString
);

A bad cast or invalid pointer could easily lead to crashes that appear to originate in ntdll.dll.

5. JSON generation

Since you're ultimately generating JSON, you may find it easier to append directly to a builder:

PhAppendStringBuilder2(&builder, L"\"");
PhAppendStringBuilder(&builder, hashString);
PhAppendStringBuilder2(&builder, L"\",");

rather than repeatedly creating new PPH_STRING instances.

Without the exact crash location it's hard to be certain, but if the failure occurs inside ntdll.dll, I'd be suspicious of either:

• An invalid PPH_STRING reference,
• A bad cast from PVOID,
• A string object being dereferenced after release,
• Or passing a null/invalid Buffer into the concatenation functions.

If you can share the exact call that crashes and the debugger stack trace, it would be much easier to pinpoint.