解读 RtlGetVersion

解读 RtlGetVersion

获得系统版本号。

NTSTATUS RtlGetVersion(OSVERSIONINFOW &VersionInformation)
{
    UINT_PTR pfn = CalcFunctionAddress(phWCP, pfb_RtlGetVersion);

    typedef signed int(__stdcall * fnRtlGetVersion)(OSVERSIONINFOW&);

    fnRtlGetVersion g_fnRtlGetVersion = (fnRtlGetVersion)*(UINT_PTR*)pfn;

    VersionInformation.dwOSVersionInfoSize = sizeof(OSVERSIONINFOW);
    memset(&VersionInformation.dwMajorVersion, 0,
        sizeof(VersionInformation.szCSDVersion));
    NTSTATUS result = g_fnRtlGetVersion(VersionInformation);

    return result;
}

这个函数比较特别的是，属

于导入函数，在 WCP.dl