----------------------------------------------------------------------------------------------------
void foo(){ PUCHAR pBuffer = NULL; *pBuffer = 'a';}void Test(){ KdPrint(("Test()!\n")); __try { foo(); } __except(EXCEPTION_EXECUTE_HANDLER) { NTSTATUS nStats = GetExceptionCode(); KdPrint(("GetExceptionCode:%x\n",nStats)); }} ----------------------------------------------------------------------------------------------------
反编译后发现Ring0和Ring3上的SEH完全一样，并且对于错误代码都是C0000005