系统是64位  在x32进程里hook ntdll!NtOpenProcess 然后转到自己驱动里  调用NtOpenProcess 参数是怎么转换的  ,试了几次无法调用成功

驱动层

         case IOCTL_NtOpenProcess:
        {
            DBG_LOG_DEBUG("IOCTL_NtOpenProcess 被调用");
            PAEAM_NtOpenProcess *ioBuffer = (PAEAM_NtOpenProcess *)pIoBuffer;
             if (ioBuffer == NULL)
            {
                status = STATUS_INVALID_PARAMETER;
                 DBG_LOG_DEBUG("IOCTL_NtOpenProcess 被调用 失败了");
            }
            else
            {
               status = ddk::myNtOpenProcess(ioBuffer->ProcessHandle,ioBuffer->DesiredAccess,ioBuffer->ObjectAttributes,ioBuffer->ClientId);
            }
            break;
        }

应用层

NTSTATUS NTAPI myNtOpenProcess
    (
    __out PHANDLE ProcessHandle,
    __in ACCESS_MASK DesiredAccess,
    __in POBJECT_ATTRIBUTES ObjectAttributes,
    __in_opt PCLIENT_ID ClientId)
{
    NTSTATUS Status;
    DWORD lResultLength;
    PAEAM_NtOpenProcess_32 param;
    param.ProcessHandle = ProcessHandle;
    param.DesiredAccess = DesiredAccess;
    param.ObjectAttributes = (ObjectAttributes;
    param.ClientId = ClientId;

    DeviceIoControl(g_Driver,IOCTL_NtOpenProcess, &param,sizeof(param),&Status,sizeof(Status),&lResultLength,0);
    return Status;
}

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课