在内核驱动程序中,内存空间的动态分配不能使用C语言的malloc等函数,取而代之的是ExAllocatePoolWithTag()和ExFreePool(),使用方法举例如下:
#defineTEST_POOL_TAG (ULONG)'test'
PUCHAR tempBuf = NULL;
tempBuf = ExAllocatePoolWithTag ( NonPagedPool,tempBufSize, TEST_POOL_TAG );
ExFreePool ( (PVOID)tempBuf ); //free memory
但此种写法在进行HLK测试时,会出现蓝屏的现象,具体的错误信息如下:
DRIVER_VERIFIER_DETECTED_VIOLATION(c4)
A device driverattempting to corrupt the system has been caught. This is
because the driverwas specified in the registry as being suspect (by the
administrator) andthe kernel has enabled substantial checking of this driver.
If the driverattempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will</