你看下文档啊，WDK文档里写着“The ProbeForWrite routine checks that a user-mode buffer actually resides in the user-mode portion of the address space, is writable, and is correctly aligned.”
在看看WRK里ProbeForWrite的代码部分：
if (Length != 0) {
//
// If the structure is not properly aligned, then raise a data
// misalignment exception.
//
ASSERT((Alignment == 1) || (Alignment == 2) ||
(Alignment == 4) || (Alignment == 8) ||
(Alignment == 16));
StartAddress = (ULONG_PTR)Address;
if ((StartAddress & (Alignment - 1)) == 0) {
//
// Compute the ending address of the structure and probe for
// write accessibility.
//
EndAddress = StartAddress + Length - 1;
if ((StartAddress <= EndAddress) &&
[B] (EndAddress < MM_USER_PROBE_ADDRESS))[/B] {
//
// N.B. Only the contents of the buffer may be probed.
// Therefore the starting byte is probed for the
// first page, and then the first byte in the page
// for each succeeding page.
//
// If this is a Wow64 process, then the native page is 4K, which
// could be smaller than the native page size/
//
EndAddress = (EndAddress & ~(PageSize - 1)) + PageSize;
do {
*(volatile CHAR *)StartAddress = *(volatile CHAR *)StartAddress;
StartAddress = (StartAddress & ~(PageSize - 1)) + PageSize;
} while (StartAddress != EndAddress);
return;
} else {
[B]ExRaiseAccessViolation();[/B]
}
} else {
ExRaiseDatatypeMisalignment();
}
}
