case IOCTL_HELLO_Read: { if (NT_SUCCESS(PsLookupProcessByProcessId((HANDLE)((PREAD_WRITE_INFO)pIoBuffer)->uPid, &pEprocess))) { KeStackAttachProcess((PRKPROCESS)pEprocess, &apc_state); if (MmIsAddressValid((PVOID)((PREAD_WRITE_INFO)pIoBuffer)->Dst)) { __try { RtlCopyMemory(pIoBuffer, (PVOID)((PREAD_WRITE_INFO)pIoBuffer)->Dst, ((PREAD_WRITE_INFO)pIoBuffer)->uSize); } __except (EXCEPTION_EXECUTE_HANDLER) { dprintf("Hello:IOCTL_HELLO_Read __except\r\n"); } } else { RtlZeroMemory(pIoBuffer, uInSize); } KeUnstackDetachProcess(&apc_state); } else { RtlZeroMemory(pIoBuffer, uInSize); } break; }
问一下哪里存在问题
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!
张新琪 __except代码中需要加一个 KeUnstackDetachProcess(&apc_state); 加上试试.