if (ImageInfo->SystemModeImage)
  {
  
  }
  else
  {
    pProcessBase = GetProcessBaseAddress(ProcessId); //获取进程基址
    if (pProcessBase == ImageInfo->ImageBase) //如果exe基址=映像基址，就修改导入表
    {
      PVOID ulImageBase = ImageInfo->ImageBase;

      pDos = (PIMAGE_DOS_HEADER)ulImageBase;
      
      ///////////////
      ProbeForRead(pDos, sizeof(IMAGE_DOS_HEADER), 1);
      pHeader = (PIMAGE_NT_HEADERS)((ULONG)uImageBase + pDos->e_lfanew);  //此行蓝屏，windbg提示访问越界
      ///////////////
      pImportDesc = (PIMAGE_IMPORT_DESCRIPTOR)((ULONG)pHeader->OptionalHeader.DataDirectory[1].VirtualAddress + ulImageBase);
      
    ............. //后面就不贴了，直接蓝在上面

PVOID GetProcessBaseAddress(IN HANDLE PID)
{
  NTSTATUS status;
  HANDLE hProcess = NULL;
  CLIENT_ID clientid;
  OBJECT_ATTRIBUTES ObjectAttributes;
  PPROCESS_BASIC_INFORMATION pProcessBaseInfo;
  ULONG returnedLength;
  PPEB Peb;
  PVOID ImageBase = NULL;

  if (KeGetCurrentIrql() >= DISPATCH_LEVEL)
  {
    return ImageBase;
  }

  InitializeObjectAttributes(&ObjectAttributes, 0, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, 0, 0);
  clientid.UniqueProcess = PID;
  clientid.UniqueThread = 0;

  status = ZwOpenProcess(&hProcess, PROCESS_ALL_ACCESS, &ObjectAttributes, &clientid);
  if (!NT_SUCCESS(status))
  {
    return ImageBase;
  }

  pProcessBaseInfo = (PPROCESS_BASIC_INFORMATION)ExAllocatePoolWithTag(NonPagedPool, sizeof(PROCESS_BASIC_INFORMATION), 'abcd');
  if (pProcessBaseInfo == NULL)
  {
    ZwClose(hProcess);
    return ImageBase;
  }
  RtlZeroMemory(pProcessBaseInfo, sizeof(PROCESS_BASIC_INFORMATION));

  status = ZwQueryInformationProcess(hProcess, ProcessBasicInformation, pProcessBaseInfo, sizeof(PROCESS_BASIC_INFORMATION), &returnedLength);
  if (NT_SUCCESS(status))
  {
    Peb = (PPEB)pProcessBaseInfo->PebBaseAddress;
    ImageBase = Peb->ImageBaseAddress;
  }
  ZwClose(hProcess);
  ExFreePool(pProcessBaseInfo);
  return ImageBase;
}

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！