驱动 C0000005错误 求教

[chao23387784]

最近在做HOOK SSDT，在自己的函数里面调用ZwSetValueKey，结果出现C000005错误，查了资料说是地址空间有问题，我把传入函数的指针参数换成全局、局部和动态申请的都出错，求教到底是哪里出了问题

UNICODE_STRING ustrStartPage
NTSTATUS SetStartPage()
{
	NTSTATUS rc = STATUS_SUCCESS;
	HANDLE hRegister;
	OBJECT_ATTRIBUTES ObjectAttributes;
	UNICODE_STRING subPath;

	UNICODE_STRING ustrSid;
	UNICODE_STRING ustrReg;
	UNICODE_STRING ustrValueName;
	UNICODE_STRING ustrTemp;
	WCHAR regbuf[1024];

	NTSETVALUEKEY OldNtSetValueKey = 
		(NTSETVALUEKEY)OldServiceAddressTable[SERVICE_ID(ZwSetValueKey)];

	GetUserSID(&ustrSid);
	//KdPrint(("GetUserSID : %S",ustrSid.Buffer));


	RtlInitUnicodeString(&subPath,L"\\Software\\Microsoft\\Internet Explorer\\Main");
	RtlInitUnicodeString(&ustrValueName,L"Start Page");
	RtlInitUnicodeString(&ustrTemp,ustrStartPage.Buffer);
	RtlInitEmptyUnicodeString(&ustrReg,regbuf,1024*sizeof(WCHAR));
	RtlCopyUnicodeString(&ustrReg,&ustrSid);
	RtlAppendUnicodeStringToString(&ustrReg, &subPath);

	InitializeObjectAttributes(&ObjectAttributes,&ustrReg,OBJ_CASE_INSENSITIVE,NULL,NULL);
	KdPrint(("key path : %S",ustrReg.Buffer));
	rc = ZwOpenKey(&hRegister,KEY_ALL_ACCESS,&ObjectAttributes);
	if(!NT_SUCCESS(rc))
	{
		KdPrint(("StartPage : OpenKey Failed!"));
		return rc;
	}
	KdPrint(("StartPage : %S , Length : %d",ustrTemp.Buffer,ustrTemp.Length));
	KdPrint(("ValueName : %S",ustrValueName.Buffer));
	rc = OldNtSetValueKey(hRegister,&ustrValueName,
		0,REG_SZ,ustrTemp.Buffer,ustrTemp.Length + sizeof(WCHAR));


	if(!NT_SUCCESS(rc))
	{
		KdPrint(("StartPage : SetValueKey Failed! Error Code : %X",rc));
		ZwClose(hRegister);
		return rc;
	}

	ZwClose(hRegister);

	return rc;
}