我想用以下代码在驱动中获得当前进程的PEB，但是每次调用NtQueryInformationProcess返回的都是0xC0000005，STATUS_ACCESS_VIOLATION ，请问要怎样才能正确的调用这个函数啊？

      PROCESS_BASIC_INFORMATION ProcessBasicInfo = {0};

      hCurrentProcess = ZwCurrentProcess();

      Status = NtQueryInformationProcess(hCurrentProcess,
        ProcessBasicInformation,
        &ProcessBasicInfo,
        sizeof(PROCESS_BASIC_INFORMATION),
        &tmp);
      if (STATUS_SUCCESS == Status)
      {
        KdPrint(("%ws\n",ProcessBasicInfo.PebBaseAddress->ProcessParameters->ImagePathName.Buffer));
      }
      else
      {
        KdPrint(("NtQueryFail:%lX,PEB:%p\n",Status,ProcessBasicInfo.PebBaseAddress));
      }

[课程]FART 脱壳王！加量不加价！FART作者讲授！