Illegal Value CryptoException when setting ECC Private Key S value in JavaCard - cryptography
I am getting an CRYPTOEXCEPTION.ILLEGAL_VALUE when attempting to set an ECPrivateKey with its S,A,B,G,R,Field values manually for a SECP-256-R1 private key.
protected static byte[] EC_P256R1_FIELD_A = {
(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0x00,(byte)0x00,(byte)0x00,(byte)0x01,
(byte)0x00,(byte)0x00,(byte)0x00,(byte)0x00,(byte)0x00,(byte)0x00,(byte)0x00,(byte)0x00,
(byte)0x00,(byte)0x00,(byte)0x00,(byte)0x00,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,
(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFC
};
protected static byte[] EC_P256R1_FIELD_B = {
(byte)0x5A,(byte)0xC6,(byte)0x35,(byte)0xD8,(byte)0xAA,(byte)0x3A,(byte)0x93,(byte)0xE7,
(byte)0xB3,(byte)0xEB,(byte)0xBD,(byte)0x55,(byte)0x76,(byte)0x98,(byte)0x86,(byte)0xBC,
(byte)0x65,(byte)0x1D,(byte)0x06,(byte)0xB0,(byte)0xCC,(byte)0x53,(byte)0xB0,(byte)0xF6,
(byte)0x3B,(byte)0xCE,(byte)0x3C,(byte)0x3E,(byte)0x27,(byte)0xD2,(byte)0x60,(byte)0x4B
};
protected static byte[] EC_P256R1_FIELD_G = {
(byte)0x04,
(byte)0x6B,(byte)0x17,(byte)0xD1,(byte)0xF2,(byte)0xE1,(byte)0x2C,(byte)0x42,(byte)0x47,
(byte)0xF8,(byte)0xBC,(byte)0xE6,(byte)0xE5,(byte)0x63,(byte)0xA4,(byte)0x40,(byte)0xF2,
(byte)0x77,(byte)0x03,(byte)0x7D,(byte)0x81,(byte)0x2D,(byte)0xEB,(byte)0x33,(byte)0xA0,
(byte)0xF4,(byte)0xA1,(byte)0x39,(byte)0x45,(byte)0xD8,(byte)0x98,(byte)0xC2,(byte)0x96,
(byte)0x4F,(byte)0xE3,(byte)0x42,(byte)0xE2,(byte)0xFE,(byte)0x1A,(byte)0x7F,(byte)0x9B,
(byte)0x8E,(byte)0xE7,(byte)0xEB,(byte)0x4A,(byte)0x7C,(byte)0x0F,(byte)0x9E,(byte)0x16,
(byte)0x2B,(byte)0xCE,(byte)0x33,(byte)0x57,(byte)0x6B,(byte)0x31,(byte)0x5E,(byte)0xCE,
(byte)0xCB,(byte)0xB6,(byte)0x40,(byte)0x68,(byte)0x37,(byte)0xBF,(byte)0x51,(byte)0xF5
};
protected static byte[] EC_P256R1_FIELD_R = {
(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0x00,(byte)0x00,(byte)0x00,(byte)0x00,
(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,
(byte)0xBC,(byte)0xE6,(byte)0xFA,(byte)0xAD,(byte)0xA7,(byte)0x17,(byte)0x9E,(byte)0x84,
(byte)0xF3,(byte)0xB9,(byte)0xCA,(byte)0xC2,(byte)0xFC,(byte)0x63,(byte)0x25,(byte)0x51
};
protected static byte[] EC_P256R1_FP = {
(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0x00,(byte)0x00,(byte)0x00,(byte)0x01,
(byte)0x00,(byte)0x00,(byte)0x00,(byte)0x00,(byte)0x00,(byte)0x00,(byte)0x00,(byte)0x00,
(byte)0x00,(byte)0x00,(byte)0x00,(byte)0x00,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,
(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF
public void initSigner(byte[] input, short offset, short len) {
ECPrivateKey tempKey = (ECPrivateKey) KeyBuilder.buildKey(KeyBuilder.TYPE_EC_FP_PRIVATE_TRANSIENT_RESET, KeyBuilder.LENGTH_EC_FP_256, false);
tempKey.setS(input, offset, len);
tempKey.setA(EC_P256R1_FIELD_A, (short) 0, (short) EC_P256R1_FIELD_A.length);
tempKey.setB(EC_P256R1_FIELD_B, (short) 0, (short) EC_P256R1_FIELD_B.length);
tempKey.setG(EC_P256R1_FIELD_G, (short) 0, (short) EC_P256R1_FIELD_G.length);
tempKey.setR(EC_P256R1_FIELD_R, (short) 0, (short) EC_P256R1_FIELD_R.length);
tempKey.setFieldFP(EC_P256R1_FP, (short) 0, (short) EC_P256R1_FP.length);
Signature signer = Signature.getInstance(Signature.ALG_ECDSA_SHA_256, true);
signer.init(tempKey, Signature.MODE_SIGN);
}
Is there anything I am missing out when setting the ECC P256R1 values manually and how do I get the above code to work ?
I figured out that the particular card does not support KeyBuilder.TYPE_EC_FP_PRIVATE_TRANSIENT_RESET thus the reason why it kept throwing CRYPTOEXCEPTION.ILLEGAL_VALUE.
Related
NAudio - ASIO Playback to device (static only)
I'm trying to route ASIO audio to my playback devices, however, all I hear is static. ASIO Setup BIT_PER_SAMPLE = 24 SAMPLE_RATE = 48000 Currently, trying with 1 channel into 1 playback device called "Line 1" for testing. The playback of the sound is static. EDIT: The code below has been updated. It will take 64 channels of ASIO input and route them one at a time into Waveout devices (I'm using Virtual Audio Cable to create them) private static AsioOut asioOut; private static AsioInputPatcher inputPatcher; private static readonly int BIT_PER_SAMPLE = 16; private static readonly int SAMPLE_RATE = 48000; private static readonly int NUMBER_OF_CHANNELS = 64; private static BufferedWaveProvider[] bufferedWaveProviders = new BufferedWaveProvider[NUMBER_OF_CHANNELS]; private static WaveOut[] waveouts = new WaveOut[NUMBER_OF_CHANNELS]; [STAThread] static void Main(string[] args) { InitDevices(); Record(); while (true) { Console.WriteLine("Recording...press any key to Exit."); Console.ReadKey(true); break; } asioOut.Stop(); asioOut.Dispose(); asioOut = null; } private static void Record() { inputPatcher = new AsioInputPatcher(SAMPLE_RATE, NUMBER_OF_CHANNELS, NUMBER_OF_CHANNELS); asioOut = new AsioOut(AsioOut.GetDriverNames()[0]); asioOut.InitRecordAndPlayback(new SampleToWaveProvider(inputPatcher), NUMBER_OF_CHANNELS, 0); asioOut.AudioAvailable += OnAsioOutAudioAvailable; asioOut.Play(); } private static void InitDevices() { for (int n = -1; n < WaveOut.DeviceCount; n++) { WaveOutCapabilities caps = WaveOut.GetCapabilities(n); if (caps.ProductName.StartsWith("Line")) { int _number = int.Parse(caps.ProductName.Split(' ')[1]); if (_number <= NUMBER_OF_CHANNELS) { waveouts[_number - 1] = new WaveOut() { DeviceNumber = n }; bufferedWaveProviders[_number - 1] = new BufferedWaveProvider(new WaveFormat(SAMPLE_RATE, BIT_PER_SAMPLE, 2)); waveouts[_number - 1].Init(bufferedWaveProviders[_number - 1]); waveouts[_number - 1].Play(); } } } } static void OnAsioOutAudioAvailable(object sender, AsioAudioAvailableEventArgs e) { inputPatcher.ProcessBuffer(e.InputBuffers, e.OutputBuffers, e.SamplesPerBuffer, e.AsioSampleType); for (int outputChannel = 0; outputChannel < e.OutputBuffers.Length; outputChannel++) { byte[] buf = new byte[e.SamplesPerBuffer * (BIT_PER_SAMPLE / 8)]; Marshal.Copy(e.OutputBuffers[outputChannel], buf, 0, e.SamplesPerBuffer * (BIT_PER_SAMPLE / 8)); bufferedWaveProviders[outputChannel].AddSamples(buf, 0, buf.Length); } e.WrittenToOutputBuffers = true; }
There are two main problems with your code. First, InputBuffers is one per channel, not sample. Second, when you set e.WrittenToOutputBuffers = true you are saying that you have written to e.OutputBuffers which you haven't. So they will just contain uninitialized data. If you want to see an example of low-level manipulation of ASIO buffers, then check out my ASIO patch bay sample project.
Java Card setExponent() method fails when exponent has more than 10 bytes
I'm trying to implement the modPow function on Java Card using the build in RSA CryptoSystem. The code seems trivial but I have issued on implementation. My code untill now : Cipher m_encryptCipherRSA = Cipher.getInstance(Cipher.ALG_RSA_NOPAD, false); // create the cipher RSAPublicKey m_rsaPublicKey = (RSAPublicKey) KeyBuilder.buildKey(KeyBuilder.TYPE_RSA_PUBLIC,KeyBuilder.LENGTH_RSA_1024,false); // create the public key m_random = RandomData.getInstance(RandomData.ALG_SECURE_RANDOM); m_random.generateData(temp1, (short)0, MODULUS_LENGTH); m_rsaPublicKey.setModulus(temp1,(short)0, MODULUS_LENGTH); //generate modulus m_random.generateData(temp1,(short)0, (short) EXPONENT_LENGTH); m_rsaPublicKey.setExponent(temp1,(short)0, (short)EXPONENT_LENGTH); The cod seems to work ok if EXPONENT_LENGTH has no more than 10 bytes.The Java Card I have has limited the dimension of public exponent. However my project is based on numbers up to 128bytes long.Is there a way to create a generic modpow function based on this hardware limitation? Is there another way I could implement the power exponentiation which is still feasible.
I managed to solve the problem by using the private exponent ( which seems not be constraint by RSA cryptosystem).Below is the working code. public byte[] modPow(byte[] x,short xOffset,short xLength,byte[] y,short yOffset,short yLength) { Util.arrayCopy(y, yOffset, tempBuffer, (short)(Configuration.TEMP_OFFSET_EXPONENT+4), yLength); Util.arrayFillNonAtomic(tempBuffer, Configuration.TEMP_OFFSET_EXPONENT, (byte)4,(byte)0x00); mRsaPrivateKeyModPow.setExponent(tempBuffer,Configuration.TEMP_OFFSET_EXPONENT, (short)(yLength+4)); mRsaCipherModPow.init(mRsaPrivateKeyModPow, Cipher.MODE_DECRYPT); Util.arrayCopy(x,xOffset,tempBuffer, Configuration.TEMP_OFFSET_RSA, Configuration.LENGTH_RSAOBJECT_MODULUS); mRsaCipherModPow.doFinal(tempBuffer,Configuration.TEMP_OFFSET_RSA, (short) (Configuration.LENGTH_RSAOBJECT_MODULUS), tempBuffer,Configuration.TEMP_OFFSET_RSA); mRsaPrivateKeyModPow.clearKey(); return tempBuffer; }
Well, I tried both RSAPublicKey and RSAPrivateKey for two different cards, and both worked fine: package soqPack; import javacard.framework.*; import javacard.security.KeyBuilder; import javacard.security.RSAPrivateKey; import javacard.security.RSAPublicKey; import javacard.security.RandomData; import javacardx.biometry.BioBuilder; import javacardx.crypto.Cipher; public class modPowtest extends Applet { //Definition Of INS in APDU command public static final byte INS_MOD_POW = (byte) 0x00; //Switch cases to choose RSA Public key or RSA Private key for ModPow() //P1 in APDU command. public static final byte USE_PUB_KEY = (byte) 0x00; public static final byte USE_PRI_KEY = (byte) 0x01; //Required objects byte[] tempMem; Cipher myCipher; RSAPrivateKey rsaPriKey; RSAPublicKey rsaPubKey; RandomData random; public static void install(byte[] bArray, short bOffset, byte bLength) { new modPowtest(); } protected modPowtest() { myCipher = Cipher.getInstance(Cipher.ALG_RSA_PKCS1, false); rsaPriKey = (RSAPrivateKey) KeyBuilder.buildKey(KeyBuilder.TYPE_RSA_PRIVATE, KeyBuilder.LENGTH_RSA_1024, false); rsaPubKey = (RSAPublicKey) KeyBuilder.buildKey(KeyBuilder.TYPE_RSA_PUBLIC, KeyBuilder.LENGTH_RSA_1024, false); tempMem = JCSystem.makeTransientByteArray((short) 0x80, JCSystem.CLEAR_ON_DESELECT); random = RandomData.getInstance(RandomData.ALG_PSEUDO_RANDOM); register(); } public void process(APDU apdu) { if (selectingApplet()) { return; } byte[] buffer = apdu.getBuffer(); switch (buffer[ISO7816.OFFSET_INS]) { case INS_MOD_POW: modPow(apdu); break; default: ISOException.throwIt(ISO7816.SW_INS_NOT_SUPPORTED); } } public void modPow(APDU apdu) { byte[] buffer = apdu.getBuffer(); switch (buffer[ISO7816.OFFSET_P1]) { case USE_PUB_KEY: random.generateData(tempMem, (short) 0x00, (short) 0x80); rsaPubKey.setModulus(tempMem, (short) 0x00, (short) 0x80); random.generateData(tempMem, (short) 0x00, (short) 0x03); rsaPubKey.setExponent(tempMem, (short) 0x00, (short) 0x03); break; case USE_PRI_KEY: random.generateData(tempMem, (short) 0x00, (short) 0x80); rsaPriKey.setModulus(tempMem, (short) 0x00, (short) 0x80); random.generateData(tempMem, (short) 0x00, (short) 0x03); rsaPriKey.setExponent(tempMem, (short) 0x00, (short) 0x03); break; default: ISOException.throwIt(ISO7816.SW_INCORRECT_P1P2); } } } Works as below: Download Cap begin... Download Cap successful. Install Applet begin... Install Applet successful. Select Applet begin... Select Applet successful. Send: 00 00 00 00 00 Recv: 90 00 Send: 00 00 01 00 00 Recv: 90 00 Update: (Related your new question in the comments and here): I also, changed value of tempMem[0] just before the setModulus and setExponent methods to 0x69, and it still works fine.
What situations provoke a .net 2.0 String constructor to throw an exception?
I have some code which sometimes (but not always) throws the exception described in a Microsoft kb article when using a particular form of the String costructor. In essence, my code looks like this (except the input string array varies in length depending on the input): int arraySize = 8; char* charArray3 = new char[arraySize]; memset(charArray3, 0x61, arraySize); char * pstr3 = &charArray3[0]; String^ szAsciiUpper = gcnew String(pstr3, 0, arraySize); The kb article suggests this 'may' cause the exception to be thrown but my unit tests and most of the time in the wild, it never appears. I'd like to know what would provoke the exception so that I can replicate it in my unit tests and verify it's fixed permanently in our codebase.
This bug appears in src/vm/comstring.cpp, COMString::StringInitCharHelper() function. This is the evil-doer: if( IsBadReadPtr(pszSource, (UINT_PTR)length + 1)) { COMPlusThrowArgumentOutOfRange(L"ptr", L"ArgumentOutOfRange_PartialWCHAR"); } Or in other words, it will peek at length+1 and take a nose-dive when IsBadReadPtr() returns false. Yes, you have to be unlucky, your charArray3 would have to be allocated exactly at the end of a memory page and the next page must be inaccessible. That doesn't happen very often. Not so sure there is any point in trying to repro the bug, it is just too random. Simply make your array 1 element bigger to avoid it. Or move to .NET 4, they did fix it simply by removing the check completely.
They fixed it in 4.0, still broken in 2.0: using System; using System.Runtime.InteropServices; namespace ConsoleApplication13 { class Program { [DllImport("kernel32.dll", SetLastError = true)] static extern IntPtr VirtualAlloc(IntPtr lpAddress, IntPtr dwSize, uint flAllocationType, uint flProtect); [DllImport("kernel32.dll", SetLastError = true)] static extern bool VirtualProtect(IntPtr lpAddress, uint dwSize, uint flNewProtect, out uint lpflOldProtect); // For .NET 4.0 //[System.Runtime.ExceptionServices.HandleProcessCorruptedStateExceptions] static unsafe void Main(string[] args) { IntPtr ptr = VirtualAlloc( IntPtr.Zero, (IntPtr)(4096 * 2), 0x1000 /* MEM_COMMIT */ | 0x2000 /* MEM_RESERVE */, 0x04 /* PAGE_READWRITE */); IntPtr page1 = ptr; IntPtr page2 = (IntPtr)((long)ptr + 4096); uint oldAccess; bool res = VirtualProtect(page2, 4096, 0x01 /* PAGE_NOACCESS */, out oldAccess); try { Marshal.WriteByte(page1, 1); Console.WriteLine("OK"); } catch (AccessViolationException) { Console.WriteLine("KO"); } try { Marshal.WriteByte(page2, 1); Console.WriteLine("KO"); } catch (AccessViolationException) { Console.WriteLine("OK"); } try { byte b1 = Marshal.ReadByte(page1); Console.WriteLine("OK"); } catch (AccessViolationException) { Console.WriteLine("KO"); } try { byte b2 = Marshal.ReadByte(page2); Console.WriteLine("KO"); } catch (AccessViolationException) { Console.WriteLine("OK"); } for (int i = 0; i < 4096; i++) { Marshal.WriteByte(page1, i, (byte)'A'); } sbyte* ptr2 = (sbyte*)page1; try { var st1 = new string(ptr2, 0, 4096); Console.WriteLine("OK"); } catch (ArgumentOutOfRangeException) { Console.WriteLine("KO"); } } } } You have to uncomment a line in .NET 4.0 . Note that this code doesn't free the memory it allocates, but it isn't a big problem, because when a process ends the memory is reclaimed by the OS. What does this program do? It allocates 8192 bytes (2 pages) using VirtualAlloc. By using VirtualAlloc the two pages are page aligned. It disable access to the second page (with VirtualProtect). Then it fills the first page with 'A'. Then it tries to create a string from the first page. On .NET 2.0, the string constructor tries to read the first byte of the second page (even if you told it that the string was only long 4096 bytes). In the middle there are some tests that check if the pages can be read/written. Normally it is difficult to check this condition because it is difficult to have a block of memory that is exactly at the end of the allocated readable memory space.
In case anyone's interested, this is how to replicate it in C++/CLI (based entirely on xanatos' answer): LPVOID ptr = VirtualAlloc(0, 4096 * 2, 0x1000, 0x04); // ReadWrite LPVOID page1 = ptr; LPVOID page2 = (LPVOID)((long)ptr + 4096); DWORD oldAccess; bool res = VirtualProtect(page2, 4096, 0x01, &oldAccess); char* ptr2 = (char*)page1; String^ st1 = gcnew String(ptr2, 0, 4096); // <-- This will cause the exception. Console::WriteLine(st1);
iTextSharp Twisting CCITTFaxDecode extracted data with GetDrawingImage()
On certain images, when I call: PdfImageObject pimg = new PdfImageObject(stream); Image bmp = pimg.GetDrawingImage(); The Image that is returned is twisted. I've seen this before and it usually has to do with byte alignment but I'm not sure how to get around this. The /DecodeParms for this object are /EndOfLine true /K 0 /Columns 3300. I have tried using the GetStreamBytesRaw() with BitMiracle.LibTiff and with it I can get the data formatted properly although the image is rotated. I'd prefer for GetDrawingImage() to decode the data properly if possible, assuming that is the problem. I could provide the PDF via email if requested. Thanks, Darren
For anyone else that runs across this scenario here is my solution. The key to this puzzle was understanding that /K 0 is G3, /K -1 (or anything less than 0) is G4 /K 1 (or anything greater than 0) is G3-2D. The twisting happens when you try to make G3 compressed data fit into a G4 image which it appears that is what iTextSharp may be doing. I know it definitely does not work with how I have iTextSharp implemented in my project. I confess that I cannot decipher all the decoding stuff that iTextSharp is doing so it could be something I'm missing too. EndOfLine didn't have any part in this puzzle but I still think putting line feeds in binary data is a strange practice. 99% of this code came from BitMiracle.LibTiff.Net - Thank you. int nK = 0;// Default to 0 like the PDF Spec PdfObject oDecodeParms = stream.Get(PdfName.DECODEPARMS); if (oDecodeParms is PdfDictionary) { PdfObject oK0 = ((PdfDictionary)oDecodeParms).Get(PdfName.K); if (oK0 != null) nK = ((PdfNumber)oK0).IntValue; } using (MemoryStream ms = new MemoryStream()) { using (Tiff tiff = Tiff.ClientOpen("custom", "w", ms, new TiffStream())) { tiff.SetField(TiffTag.IMAGEWIDTH, width); tiff.SetField(TiffTag.IMAGELENGTH, height); if (nK == 0 || nK > 0) // 0 = Group 3, > 0 = Group 3 2D tiff.SetField(TiffTag.COMPRESSION, Compression.CCITTFAX3); else if (nK < 0) // < 0 = Group 4 tiff.SetField(TiffTag.COMPRESSION, Compression.CCITTFAX4); tiff.SetField(TiffTag.BITSPERSAMPLE, bpc); tiff.SetField(TiffTag.SAMPLESPERPIXEL, 1); tiff.WriteRawStrip(0, rawBytes, rawBytes.Length); //saving the tiff file using the raw bytes retrieved from the PDF. tiff.Close(); } TiffStreamForBytes byteStream = new TiffStreamForBytes(ms.ToArray()); using (Tiff input = Tiff.ClientOpen("bytes", "r", null, byteStream)) { int stride = input.ScanlineSize(); Bitmap result = new Bitmap(width, height, pixelFormat); ColorPalette palette = result.Palette; palette.Entries[0] = System.Drawing.Color.White; palette.Entries[1] = System.Drawing.Color.Black; result.Palette = palette; for (int i = 0; i < height; i++) { Rectangle imgRect = new Rectangle(0, i, width, 1); BitmapData imgData = result.LockBits(imgRect, ImageLockMode.WriteOnly, pixelFormat); byte[] buffer = new byte[stride]; input.ReadScanline(buffer, i); System.Runtime.InteropServices.Marshal.Copy(buffer, 0, imgData.Scan0, buffer.Length); result.UnlockBits(imgData); } } } /// <summary> /// Custom read-only stream for byte buffer that can be used /// with Tiff.ClientOpen method. /// </summary> public class TiffStreamForBytes : TiffStream { private byte[] m_bytes; private int m_position; public TiffStreamForBytes(byte[] bytes) { m_bytes = bytes; m_position = 0; } public override int Read(object clientData, byte[] buffer, int offset, int count) { if ((m_position + count) > m_bytes.Length) return -1; Buffer.BlockCopy(m_bytes, m_position, buffer, offset, count); m_position += count; return count; } public override void Write(object clientData, byte[] buffer, int offset, int count) { throw new InvalidOperationException("This stream is read-only"); } public override long Seek(object clientData, long offset, SeekOrigin origin) { switch (origin) { case SeekOrigin.Begin: if (offset > m_bytes.Length) return -1; m_position = (int)offset; return m_position; case SeekOrigin.Current: if ((offset + m_position) > m_bytes.Length) return -1; m_position += (int)offset; return m_position; case SeekOrigin.End: if ((m_bytes.Length - offset) < 0) return -1; m_position = (int)(m_bytes.Length - offset); return m_position; } return -1; } public override void Close(object clientData) { // nothing to do return; } public override long Size(object clientData) { return m_bytes.Length; } }
WINCODEC_ERR_WIN32ERROR 0x88982F94 when calling IWICComponentFactory.CreateBitmapFromMemory
I'm getting the following error when calling IWICComponentFactory.CreateBitmapFromMemory and passing it a pointer to Scan0 of a 32bppArgb GDI+ bitmap WINCODEC_ERR_WIN32ERROR 0x88982F94 Windows Codecs received an error from the Win32 system. IWICComponentFactory interface decl: new IWICBitmap CreateBitmapFromMemory( uint uiWidth, uint uiHeight, [MarshalAs(UnmanagedType.LPStruct)] Guid pixelFormat, uint cbStride, uint cbBufferSize, [MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 5)] byte[] pbBuffer ); new IWICBitmap CreateBitmapFromMemory( uint uiWidth, uint uiHeight, [MarshalAs(UnmanagedType.LPStruct)] Guid pixelFormat, uint cbStride, uint cbBufferSize, IntPtr pbBuffer ); Full code: public static IWICBitmap ToWic(IWICComponentFactory factory, Bitmap bit) { BitmapData bd = bit.LockBits(new Rectangle(0, 0, bit.Width, bit.Height), ImageLockMode.ReadOnly, bit.PixelFormat); IWICBitmap b = null; try { //Create WIC bitmap directly from unmanaged memory b = factory.CreateBitmapFromMemory((uint)bit.Width, (uint)bit.Height, ConversionUtils.FromPixelFormat(bit.PixelFormat), (uint)bd.Stride, (uint)(bd.Stride * bd.Height), bd.Scan0); return b; } finally { bit.UnlockBits(bd); } } Width, Height, buffer size, format GUID, and scan size all seem correct. I can't figure out why this is happening (there are no google results for the error code or message
This isn't an answer as to why the original code doesn't work - but it's a workaround. Using IWICImagingFactory_CreateBitmapFromMemory_Proxy , everything works fine. But why didn't the original work as it's supposed to? And why the _Proxy methods with near-identical signatures? [DllImport("WindowsCodecs.dll", EntryPoint = "IWICImagingFactory_CreateBitmapFromMemory_Proxy")] internal static extern int CreateBitmapFromMemory(IWICComponentFactory factory, uint width, uint height, ref Guid pixelFormatGuid, uint stride, uint cbBufferSize, IntPtr pvPixels, out IWICBitmap ppIBitmap); public static IWICBitmap ToWic(IWICComponentFactory factory, Bitmap bit) { Guid pixelFormat = ConversionUtils.FromPixelFormat(bit.PixelFormat); if (pixelFormat == Guid.Empty) throw new NotSupportedException("PixelFormat " + bit.PixelFormat.ToString() + " not supported."); BitmapData bd = bit.LockBits(new Rectangle(0, 0, bit.Width, bit.Height), ImageLockMode.ReadOnly, bit.PixelFormat); IWICBitmap b = null; try { //Create WIC bitmap directly from unmanaged memory long result = CreateBitmapFromMemory(factory, (uint)bit.Width, (uint)bit.Height, ref pixelFormat, (uint)bd.Stride, (uint)(bd.Stride * bd.Height), bd.Scan0, out b); if (result == 0x80070057) throw new ArgumentException(); if (result < 0) throw new Exception("HRESULT " + result); return b; } finally { bit.UnlockBits(bd); } } For reference, here is the COM method and here is the proxy method. Both use [IN] BYTE *pbBuffer.