[英]Why does (ULONG_PTR)x > (ULONG_PTR)y comparison fail?
0x8A81FAA
is less then 0x7FFFFFF0000
so why is it true? 0x8A81FAA
小于0x7FFFFFF0000
那么为什么是真的?
#if defined(_X86_)
#define ProbeForReadUnicodeStringFullBuffer(String) \
if (((ULONG_PTR)((String).Buffer) & (sizeof(BYTE) - 1)) != 0) { \
ExRaiseDatatypeMisalignment(); \
} else if ((((ULONG_PTR)((String).Buffer) + ((String).MaximumLength)) < (ULONG_PTR)((String).Buffer)) || \
(((ULONG_PTR)((String).Buffer) + ((String).MaximumLength)) > (ULONG_PTR)MM_USER_PROBE_ADDRESS)) { \
ExRaiseAccessViolation(); \
} else if (((String).Length) > ((String).MaximumLength)) { \
ExRaiseAccessViolation(); \
}
#else
#define ProbeForReadUnicodeStringFullBuffer(String) \
if (((ULONG_PTR)((String).Buffer) & (sizeof(WCHAR) - 1)) != 0) { \
DbgPrint("aaaaaa");\
ExRaiseDatatypeMisalignment(); \
} else if ((((ULONG_PTR)((String).Buffer) + ((String).MaximumLength)) < (ULONG_PTR)((String).Buffer)) || \
(((ULONG_PTR)((String).Buffer) + ((String).MaximumLength)) > (ULONG_PTR)MM_USER_PROBE_ADDRESS)) { \
DbgPrint("bool = %d\n", (((ULONG_PTR)((String).Buffer) + ((String).MaximumLength)) < (ULONG_PTR)((String).Buffer))); \
DbgPrint("bool2 = %d\n", (((ULONG_PTR)((String).Buffer) + ((String).MaximumLength)) > (ULONG_PTR)MM_USER_PROBE_ADDRESS)); \
DbgPrint("fsdgfd = %d\n", ((ULONG_PTR)((String).Buffer) + ((String).MaximumLength)));\
DbgPrint("asdasd = %llu\n", (ULONG_PTR)MM_USER_PROBE_ADDRESS);\
DbgPrint("bbbbbbb : %d %d %llu\n", ((ULONG_PTR)((String).Buffer) + ((String).MaximumLength)), (ULONG_PTR)((String).Buffer), (ULONG_PTR)MM_USER_PROBE_ADDRESS);\
ExRaiseAccessViolation(); \
} else if (((String).Length) > ((String).MaximumLength)) { \
DbgPrint("cccccccc");\
ExRaiseAccessViolation(); \
}
#endif
Turns out if you change原来如果你改变
DbgPrint("fsdgfd = %d\n", ((ULONG_PTR)((String).Buffer) + ((String).MaximumLength)));\
to到
DbgPrint("fsdgfd = %llu\n", ((ULONG_PTR)((String).Buffer) + ((String).MaximumLength)));\
the value shows up as该值显示为
0xFFFFF8A020CB18EA
after more research i figured out I don't even need a ProbeForRead as the pointer is a KernelMode pointer and there is no need to validate the kernelmode pointers, they are trusted.经过更多研究,我发现我什至不需要 ProbeForRead,因为指针是 KernelMode 指针,不需要验证内核模式指针,它们是可信的。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.