Win7打印IAT表单直接蓝屏。XP下面没有问题

  PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)Base;
  PIMAGE_NT_HEADERS32 pNtHeader32;
  PIMAGE_NT_HEADERS64 pNtHeader64;
  PIMAGE_IMPORT_DESCRIPTOR pIatDes;
  PIMAGE_IMPORT_BY_NAME ImportByName;
  BOOLEAN b64 = FALSE;
  NTSTATUS ns=STATUS_NOT_FOUND;

  //首先检查是否是有效的PE结构
  if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE)
  {
    DbgPrint("PIMAGE_DOS_HEADER,获取出错");
    return STATUS_INVALID_IMAGE_FORMAT;
  }
  DbgPrint("PIMAGE_DOS_HEADER,获取成功");
  //得到NT头
  pNtHeader32 = (PIMAGE_NT_HEADERS32)((PUCHAR)Base + pDosHeader->e_lfanew);
  if (pNtHeader32->Signature != IMAGE_NT_SIGNATURE)
  {
    DbgPrint("PIMAGE_NT_HEADERS32,获取出错");
    return STATUS_INVALID_IMAGE_FORMAT;
  }
  DbgPrint("PIMAGE_NT_HEADERS32,获取成功");

  if (pNtHeader32->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64) //64bit
  {
    b64 = TRUE;
    pNtHeader64 = (PIMAGE_NT_HEADERS64)((PUCHAR)Base+((PIMAGE_DOS_HEADER)Base)->e_lfanew);
    pIatDes = (PIMAGE_IMPORT_DESCRIPTOR)((PUCHAR)Base + pNtHeader64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
  } 
  else if(pNtHeader32->FileHeader.Machine == IMAGE_FILE_MACHINE_I386) //32bit
  {
    pIatDes = (PIMAGE_IMPORT_DESCRIPTOR)((PUCHAR)Base + pNtHeader32->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
  } 
  else
  {
    return STATUS_INVALID_IMAGE_FORMAT;
  }

  for (;pIatDes->Name;pIatDes++)
  {
    //如果是64位
    if (b64)
    {
      PIMAGE_THUNK_DATA64 pThunk64;
      for (pThunk64 = (PIMAGE_THUNK_DATA64)((PUCHAR)Base+pIatDes->FirstThunk);pThunk64->u1.Function;pThunk64++)
      {
        DbgPrint("64bit-->Import Module %s[0x%08x]\r\n",(PCSTR)((PUCHAR)Base+pIatDes->Name),(ULONG_PTR)pThunk64->u1.Function);
      }
    } 
    else
    {
      PIMAGE_THUNK_DATA32 pThunk32;
      for (pThunk32 = (PIMAGE_THUNK_DATA32)((PUCHAR)Base+pIatDes->FirstThunk);pThunk32->u1.Function;pThunk32++)
      {
        DbgPrint("32bit-->Import Module %s[0x%08x]\r\n",(PCSTR)((PUCHAR)Base+pIatDes->Name),(ULONG_PTR)pThunk32->u1.Function);
      }
    }
  }
  return STATUS_SUCCESS;
}

还有一个问题，“(PUCHAR)Base”这里为什么用PUCHAR而不是PULONG之类的！！