驱动程序中使用SEH

----------------------------------------------------------------------------------------------------

void foo()
{

	PUCHAR pBuffer = NULL;
	*pBuffer = 'a';
}
void Test()
{
	KdPrint(("Test()!\n"));
	
	__try
	{
		foo();
	}
	__except(EXCEPTION_EXECUTE_HANDLER)
	{
		NTSTATUS nStats = GetExceptionCode();
		KdPrint(("GetExceptionCode:%x\n",nStats));
	}
}

----------------------------------------------------------------------------------------------------

反编译后发现Ring0和Ring3上的SEH完全一样,并且对于错误代码都是C0000005

posted @ 2010-03-24 15:23  Fan Zhang  阅读(285)  评论(0)    收藏  举报