函数名获取函数地址 MmGetSystemRoutineAddress

#include<ntifs.h>


VOID DriverUnLoad(PDRIVER_OBJECT pDriverObject)
{
	DbgPrint("驱动已卸载...");
}

NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING pRegPath)
{

	NTSTATUS Status;
	ULONG RetAddress;

	pDriverObject->DriverUnload = DriverUnLoad;
	UNICODE_STRING str1;
	RtlInitUnicodeString(&str1, L"PsSynchronizeWithThreadInsertion");
		ULONG PsSynchronizeWithThreadInsertion =(ULONG) MmGetSystemRoutineAddress(&str1);
		KdPrint(("PsSynchronizeWithThreadInsertion %x\n", PsSynchronizeWithThreadInsertion));
	
	return STATUS_SUCCESS;
}