阅读:1217回复:3
获取当前进程所在的Volume,蓝屏!
ULONG dwAddress;
WCHAR procress[256]; memset(procress, 0, sizeof(WCHAR)*256); if(KeGetCurrentIrql() != PASSIVE_LEVEL) { return FALSE; } dwAddress = (long)PsGetCurrentProcess(); if(dwAddress == 0 || dwAddress == 0xFFFFFFFF) { return FALSE; } dwAddress += 0x01B0; if((dwAddress = *(long*)dwAddress) == 0) { return FALSE; } dwAddress += 0x0010; if((dwAddress = *(long*)dwAddress) == 0) { return FALSE; } dwAddress += 0x3C; if((dwAddress = *(long*)dwAddress) == 0) { return FALSE; } RtlCopyMemory(path, (WCHAR *)dwAddress, 16*sizeof(WCHAR)); if( _wcsnicmp(procress, L"\\", 1) == 0 ) //就是这句出错, 在某些时候要蓝屏! 为什么? { return FALSE; } //上面那句就是要出错啊!! |
|
|
沙发#
发布于:2007-02-21 10:31
OS版本判断过了,偏移我也是正确的!!
是最后在处理dwAddress的时候出了问题! 问题已搞定, 谢谢两位! |
|
|