NTSTATUS FILEWRITE_Write(
        IN PDEVICE_OBJECT                DeviceObject,
        IN PIRP                                        Irp
        )
{
        KdPrint(("FILEWRITE_Write\n"));
        NTSTATUS status=STATUS_SUCCESS;
        PIO_STACK_LOCATION stack=IoGetCurrentIrpStackLocation(Irp);
        PDEVICE_EXTENSION pDevExt=(PDEVICE_EXTENSION)DeviceObject->DeviceExtension;
        ULONG ulWriteLen=stack->Parameters.Write.Length;
        ULONG ulWriteOffset=stack->Parameters.Write.ByteOffset.QuadPart;

        KdPrint(("WriteLength:%d,WriteOffset:%d\n",ulWriteLen,ulWriteOffset));
        __try
        {
                KdPrint(("Enter try\n"));
                pDevExt->buffer=(PUCHAR)ExAllocatePoolWithTag(PagedPool,32,'t');
                ProbeForWrite(pDevExt->buffer,4,10);
                memcpy(pDevExt->buffer+ulWriteOffset,Irp->AssociatedIrp.SystemBuffer,ulWriteLen);
        }
        __except(EXCEPTION_EXECUTE_HANDLER)
        {
                KdPrint(("Write Faild\n"));
                status=STATUS_UNSUCCESSFUL;
        }

        Irp->IoStatus.Status=status;
        Irp->IoStatus.Information=ulWriteLen;
        IoCompleteRequest(Irp,IO_NO_INCREMENT);
        KdPrint(("FILEWRITE_Write out\n"));
        return status;
}
问题总出在ExAllocatePoolWithTag这个函数上 折腾了很久 都解决不了 求助各位大牛啊

[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法