#include "windows.h"
#include "winioctl.h"
#define MY_DVC_IN_CODE \
CTL_CODE(FILE_DEVICE_UNKNOWN, \
0xa01, \
METHOD_BUFFERED, \
FILE_READ_DATA|FILE_WRITE_DATA)
int main(){
HANDLE hDevice=CreateFile("\\\\.\\ExRYY",GENERIC_READ|GENERIC_WRITE,FILE_SHARE_READ|FILE_SHARE_WRITE,0,OPEN_EXISTING,FILE_ATTRIBUTE_SYSTEM,0);
HANDLE EventHandle=
CreateEvent(NULL,TRUE,FALSE,"ExRYY");
DWORD EventNumber;
BOOL EventBool=DeviceIoControl(hDevice, MY_DVC_IN_CODE,(void*)EventHandle,sizeof(HANDLE),NULL,0,&EventNumber,(LPOVERLAPPED)NULL);
DWORD Error =GetLastError();
CloseHandle(EventHandle);
return 1;
}
就这样的代码，为什么会出现error=998内存分配访问失败错误，hDevice是个有效的设备句柄.
但是如果把DeviceIoControl(hDevice, MY_DVC_IN_CODE,(void*)EventHandle,sizeof(HANDLE)NULL,0,&EventNumber,(LPOVERLAPPED)NULL);
改成DeviceIoControl(hDevice, MY_DVC_IN_CODE,0,0,NULL,0,&EventNumber,(LPOVERLAPPED)NULL);就可以在monitor里看到我自己的驱动打印出来的信息了。
为什么EventHandle会内存分配访问失败？
大家看看，先谢谢了。
[课程]FART 脱壳王！加量不加价！FART作者讲授！
