修改ebp带来的问题一例

        一般情况下我们很少去修改ebp，即使使用汇编也只是用到eax 、ebx等几个通用寄存器，ebp和esp都是让编译器自动安排的。但有时ebp的修改就成为必须，如进行inline hook的时候，这时就要小心因为ebp的修改而带来的bug，以下为示例代码：

 

NTSTATUS My_PsCreateSystemThread(                                                                       

                            _Out_      PHANDLE ThreadHandle,
                            _In_       ULONG DesiredAccess,
                            _In_opt_   POBJECT_ATTRIBUTES ObjectAttributes,
                            _In_opt_   HANDLE ProcessHandle,
                            _Out_opt_  PCLIENT_ID ClientId,
                            _In_       PKSTART_ROUTINE StartRoutine,
                            _In_opt_   PVOID StartContext
                           )
{
    char *FuncAddr = NULL;
    UNICODE_STRING UniCodeFunctionName;
    NTSTATUS ntStatus = STATUS_SUCCESS;

    RtlInitUnico