-
-
[求助]拷贝内核模块内存蓝屏
-
发表于:
2014-7-29 13:59
4578
-
下面是枚举内核模块的代码,中间有一段拷贝内核模块内存
PLIST_ENTRY pEntry = pLDREntry->InLoadOrderLinks.Blink;
UNICODE_STRING wStrTmp;
LONG nCount = 0;
PVOID pNewBuffer;
pNewBuffer = ExAllocatePool(PagedPool, PAGE_SIZE);
while(TRUE)
{
PLDR_DATA_TABLE_ENTRY pTmpPLDREntry = (PLDR_DATA_TABLE_ENTRY)pEntry;
if (pTmpPLDREntry == pLDREntry)
{
break;
}
pEntry = pTmpPLDREntry->InLoadOrderLinks.Blink;
if (pTmpPLDREntry->DllBase != 0 && pTmpPLDREntry->SizeOfImage > 0)
{
DbgPrint("驱动模块:BaseName:%wZ,EntryPoint:%08X,DllBase:%08X,SizeOfImage:%08X\n",
&pTmpPLDREntry->BaseDllName, pTmpPLDREntry->EntryPoint, pTmpPLDREntry->DllBase, pTmpPLDREntry->SizeOfImage);
RtlCopyMemory(pNewBuffer, pTmpPLDREntry->DllBase, PAGE_SIZE); // 蓝屏
nCount++;
}
}
内核模块内存不允许访问吗?
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课