__try
{
KeStackAttachProcess(hClient, &apc_state);
ProbeForRead((CONST PVOID)w_poReadStruct->UserBufferAdress, w_poReadStruct->ReadSize, sizeof(CHAR));
RtlCopyMemory(DriverBuffer, w_poReadStruct->UserBufferAdress, w_poReadStruct->ReadSize);
KeUnstackDetachProcess(&apc_state);
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
KeUnstackDetachProcess(&apc_state);
NtStatus = STATUS_ABANDONED;
}
__try
{
KeStackAttachProcess(hGame, &apc_state);
ProbeForRead((CONST PVOID)w_poReadStruct->GameAddressOffset, w_poReadStruct->ReadSize, sizeof(CHAR));
RtlCopyMemory(w_poReadStruct->GameAddressOffset, DriverBuffer, w_poReadStruct->ReadSize);
KeUnstackDetachProcess(&apc_state);
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
KeUnstackDetachProcess(&apc_state);
NtStatus = STATUS_ABANDONED;
}
这是一段驱动内存写入的部分代码，但是测试很明显这段代码写入没有成功，求高手指点迷津
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
hzqst
