case IOCTL_HELLO_Read: { if (NT_SUCCESS(PsLookupProcessByProcessId((HANDLE)((PREAD_WRITE_INFO)pIoBuffer)->uPid, &pEprocess))) { KeStackAttachProcess((PRKPROCESS)pEprocess, &apc_state); if (MmIsAddressValid((PVOID)((PREAD_WRITE_INFO)pIoBuffer)->Dst)) { __try { RtlCopyMemory(pIoBuffer, (PVOID)((PREAD_WRITE_INFO)pIoBuffer)->Dst, ((PREAD_WRITE_INFO)pIoBuffer)->uSize); } __except (EXCEPTION_EXECUTE_HANDLER) { dprintf("Hello:IOCTL_HELLO_Read __except\r\n"); } } else { RtlZeroMemory(pIoBuffer, uInSize); } KeUnstackDetachProcess(&apc_state); } else { RtlZeroMemory(pIoBuffer, uInSize); } break; }
问一下哪里存在问题
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课
张新琪 __except代码中需要加一个 KeUnstackDetachProcess(&apc_state); 加上试试.