不说废话了,先上源码
#pragma PAGEDCODE
VOID GetCurrentProcessFullImageName(
IN OUT PUNICODE_STRING fullImageName,
IN OUT USHORT* numberOfByteRead)
{
PUCHAR pEprocess=(PUCHAR)PsGetCurrentProcess();
PUCHAR pPeb=(PUCHAR)(*(ULONG*)(pEprocess+0x1b0));
PUCHAR pProcessParameters=(PUCHAR)(*(ULONG*)(pPeb+0x010));
PUNICODE_STRING pImagePathName=(PUNICODE_STRING)(pProcessParameters+0x038);
if (fullImageName!=NULL)
{
RtlCopyUnicodeString(fullImageName,pImagePathName);
}
*numberOfByteRead=pImagePathName->Length;
}
NTSTATUS HelloDDKDispatchRoutin(IN PDEVICE_OBJECT pDevObj,
IN PIRP pIrp)
{
KdPrint(("Enter HelloDDKDispatchRoutin\n"));
UNICODE_STRING fullImageName;
USHORT length;
GetCurrentProcessFullImageName(NULL,&length);
fullImageName.Length=0;
fullImageName.MaximumLength=(length+2);
fullImageName.Buffer=(PWSTR)
ExAllocatePoolWithTag(PagedPool,length+2,(ULONG)("SNZY"));
RtlZeroMemory(fullImageName.Buffer,length+2);
GetCurrentProcessFullImageName(&fullImageName,&length);
DbgPrint("FullImageName:[COLOR="Magenta"]%wZ[/COLOR]\n",&fullImageName);
DbgPrint("FullImageName:[COLOR="Magenta"]%S[/COLOR]\n",fullImageName.Buffer);
.
.
.
}
然后是HelloDDKDispatchRoutin调用这个函数之后,用DbgPrint打印出的信息
FullImageName:C:\Documents and Settings\Administrator\
但是在GetCurrentProcessFullImageName中加一个断点然后用dt指令显示pImagePathName和fullImageName都是
C:\Documents and Settings\Administrator\桌面\DispatchTest\Test\Debug\Test.exe
这个才是正确的,而且在Memory窗口中显示的内容也没问题
e1222710 43 00 3a 00 5c 00 44 00 6f 00 63 00 75 00 6d 00 65 00 C.:.\.D.o.c.u.m.e.
e1222722 6e 00 74 00 73 00 20 00 61 00 6e 00 64 00 20 00 53 00 n.t.s. .a.n.d. .S.
e1222734 65 00 74 00 74 00 69 00 6e 00 67 00 73 00 5c 00 41 00 e.t.t.i.n.g.s.\.A.
e1222746 64 00 6d 00 69 00 6e 00 69 00 73 00 74 00 72 00 61 00 d.m.i.n.i.s.t.r.a.
e1222758 74 00 6f 00 72 00 5c 00
4c 68 62 97 5c 00 44 00 69 00 t.o.r.\.Lhb.\.D.i.
e122276a 73 00 70 00 61 00 74 00 63 00 68 00 54 00 65 00 73 00 s.p.a.t.c.h.T.e.s.
e122277c 74 00 5c 00 54 00 65 00 73 00 74 00 5c 00 44 00 65 00 t.\.T.e.s.t.\.D.e.
e122278e 62 00 75 00 67 00 5c 00 54 00 65 00 73 00 74 00 2e 00 b.u.g.\.T.e.s.t...
e12227a0 65 00 78 00 65 00 00 00 14 02 05 00 47 6c 61 3a 38 ac e.x.e.......Gla:8.
到底是我的错,还是Windbg的错,请高手指教
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
