用 ZwAllocateVirtualMemory 来申请内存

用ZwOpenProcess ZwAllocateVirtualMemory 这两个函数 申请内存 

#include <ntddk.h>
//ZwAllocateVirtualMemory(hProcess,&AllocateAddress,0,&RegionSize,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
NTSTATUS ZwAllocateVirtualMemory(
IN HANDLE  ProcessHandle,
IN OUT PVOID  *BaseAddress,
IN ULONG  ZeroBits,
IN OUT PSIZE_T  RegionSize,
IN ULONG  AllocationType,
IN ULONG  Protect
);

NTSTATUS readprocess()
{
	NTSTATUS ntstatus;
	HANDLE   h_handle=NULL;
	CLIENT_ID id;
	OBJECT_ATTRIBUTES object;
	size_t size;
	PVOID addr;
	id.UniqueThread = 0;
	id.UniqueProcess = (HANDLE)436;
	memset(&object, 0, sizeof(object));
	ntstatus = ZwOpenProcess(&h_handle, PROCESS_ALL_ACCESS, &object, &id);
	if (!NT_SUCCESS(ntstatus))
	{
		KdPrint(("error code:%X ZWOPEN", ntstatus));
		if (h_handle != NULL)
			ZwClose(h_handle);
		return ntstatus;
	}
	size = 0xff;
	ntstatus = ZwAllocateVirtualMemory(h_handle, &addr, 0, &size, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
	if (!NT_SUCCESS(ntstatus))
	{
		KdPrint(("error code:%x  ZWALL", ntstatus));
		if (h_handle != NULL)
			ZwClose(h_handle);
		return ntstatus;
	}
	KdPrint(("addr:%x  size %x", addr, size));
	ZwClose(h_handle); 
	return ntstatus;
}
VOID DriverUnload(PDRIVER_OBJECT driver)
{
	KdPrint(("goodbye"));
}

NTSTATUS DriverEntry(PDRIVER_OBJECT driver, PUNICODE_STRING reg_path)
{
	readprocess();
	driver->DriverUnload = DriverUnload;
	return STATUS_SUCCESS;
}