----------------------------------------------------------------------------------------------------
void foo() { PUCHAR pBuffer = NULL; *pBuffer = 'a'; } void Test() { KdPrint(("Test()!\n")); __try { foo(); } __except(EXCEPTION_EXECUTE_HANDLER) { NTSTATUS nStats = GetExceptionCode(); KdPrint(("GetExceptionCode:%x\n",nStats)); } }
----------------------------------------------------------------------------------------------------
反编译后发现Ring0和Ring3上的SEH完全一样,并且对于错误代码都是C0000005