case IOCTL_HELLO_Read: { if (NT_SUCCESS(PsLookupProcessByProcessId((HANDLE)((PREAD_WRITE_INFO)pIoBuffer)->uPid, &pEprocess))) { KeStackAttachProcess((PRKPROCESS)pEprocess, &apc_state); if (MmIsAddressValid((PVOID)((PREAD_WRITE_INFO)pIoBuffer)->Dst)) { __try { RtlCopyMemory(pIoBuffer, (PVOID)((PREAD_WRITE_INFO)pIoBuffer)->Dst, ((PREAD_WRITE_INFO)pIoBuffer)->uSize); } __except (EXCEPTION_EXECUTE_HANDLER) { dprintf("Hello:IOCTL_HELLO_Read __except\r\n"); } } else { RtlZeroMemory(pIoBuffer, uInSize); } KeUnstackDetachProcess(&apc_state); } else { RtlZeroMemory(pIoBuffer, uInSize); } break; }
问一下哪里存在问题
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)
张新琪 __except代码中需要加一个 KeUnstackDetachProcess(&apc_state); 加上试试.