----------------------------------------------------------------------------------------------------
void foo()
{
PUCHAR pBuffer = NULL;
*pBuffer = 'a';
}
void Test()
{
KdPrint(("Test()!\n"));
__try
{
foo();
}
__except(EXCEPTION_EXECUTE_HANDLER)
{
NTSTATUS nStats = GetExceptionCode();
KdPrint(("GetExceptionCode:%x\n",nStats));
}
}
----------------------------------------------------------------------------------------------------
反编译后发现Ring0和Ring3上的SEH完全一样，并且对于错误代码都是C0000005