-
-
[求助]频繁调用KeAttachProcess蓝屏
-
发表于:
2015-8-14 14:55
5460
-
[求助]频繁调用KeAttachProcess蓝屏
PEPROCESS oldEprocess = PsGetCurrentProcess();
if(Eprocess!=SystemEProcess)
{
KSPIN_LOCK WriteMemLock;
KIRQL OldIrql;
KeInitializeSpinLock(&WriteMemLock);
KeAcquireSpinLock(&WriteMemLock,&OldIrql);
KeAttachProcess(Eprocess);
uRet = (UNICODE_STRING*)((ULONG_PTR)Eprocess + CHKernelHelp::EpGetEprocessOffset(PROCESS_OFFSET_SeAuditProcessCreationInfo));
CHLOG(" %X \r\n",uRet->Buffer);
KeAttachProcess(oldEprocess);
KeReleaseSpinLock(&WriteMemLock,OldIrql);
}
代码如上
外层是循环 KeAttachProcess(oldEprocess); 这句话蓝屏
调用一次没问题 但是多调用几次就蓝了
本人新学请路过大牛指点
[课程]Android-CTF解题方法汇总!