typedef struct _UNINITIALIZED_MEMORY_STACK

{

    ULONG Value;

    FunctionPointer Callback;

    ULONG Buffer[58];

} UNINITIALIZED_MEMORY_STACK, *PUNINITIALIZED_MEMORY_STACK;

NTSTATUS

TriggerUninitializedMemoryStack( _In_ PVOID UserBuffer)

{

    ULONG UserValue = 0;

    ULONG MagicValue = 0xBAD0B0B0;

    NTSTATUS Status = STATUS_SUCCESS;

#ifdef SECURE

    //安全版本

    UNINITIALIZED_MEMORY_STACK UninitializedMemory = { 0 };

#else

    //漏洞版本

    UNINITIALIZED_MEMORY_STACK UninitializedMemory;

#endif

    PAGED_CODE();

    __try

    {

        ProbeForRead(UserBuffer, sizeof(UNINITIALIZED_MEMORY_STACK), (ULONG)__alignof(UCHAR));

        // Get the value from user mode

        UserValue = *(PULONG)UserBuffer;

        DbgPrint("[+] UserValue: 0x%p\n", UserValue);

        DbgPrint("[+] UninitializedMemory Address: 0x%p\n", &UninitializedMemory);

        // Validate the magic value

        if (UserValue == MagicValue) 

		{

            UninitializedMemory.Value = UserValue;

            UninitializedMemory.Callback = &UninitializedMemoryStackObjectCallback;//自定义内核函数  无意义

        }

        DbgPrint("[+] UninitializedMemory.Value: 0x%p\n", UninitializedMemory.Value);

        DbgPrint("[+] UninitializedMemory.Callback: 0x%p\n", UninitializedMemory.Callback);

#ifndef SECURE

        DbgPrint("[+] Triggering Uninitialized Memory in Stack\n");

#endif

        // Call the callback function

        if (UninitializedMemory.Callback)

        {

            UninitializedMemory.Callback();

        }

    }

    __except (EXCEPTION_EXECUTE_HANDLER)

    {

        Status = GetExceptionCode();

        DbgPrint("[-] Exception Code: 0x%X\n", Status);

    }

    return Status;

}