__try
{
KeStackAttachProcess(hClient, &apc_state);
ProbeForRead((CONST PVOID)w_poReadStruct->UserBufferAdress, w_poReadStruct->ReadSize, sizeof(CHAR));
RtlCopyMemory(DriverBuffer, w_poReadStruct->UserBufferAdress, w_poReadStruct->ReadSize);
KeUnstackDetachProcess(&apc_state);
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
KeUnstackDetachProcess(&apc_state);
NtStatus = STATUS_ABANDONED;
}
__try
{
KeStackAttachProcess(hGame, &apc_state);
ProbeForRead((CONST PVOID)w_poReadStruct->GameAddressOffset, w_poReadStruct->ReadSize, sizeof(CHAR));
RtlCopyMemory(w_poReadStruct->GameAddressOffset, DriverBuffer, w_poReadStruct->ReadSize);
KeUnstackDetachProcess(&apc_state);
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
KeUnstackDetachProcess(&apc_state);
NtStatus = STATUS_ABANDONED;
}
这是一段驱动内存写入的部分代码，但是测试很明显这段代码写入没有成功，求高手指点迷津
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
hzqst
