GetSystemStore

int GetSystemStore(IUnknown **vfptr){#if _DEBUG    cout << endl;    cout << "调用 GetSystemStore" << endl;#endif // _DEBUG    int pfb = 0x100AD7A0;    int pfn = (int)phWCP - 0x10000000 + pfb;    typedef INT(__stdcall * fnGetSystemStore)(int a1, _GUID *a2, IUnknown **vfptr);    fnGetSystemStore g_fnGetSystemStore;    g_fnGetSystemStore = (fnGetSystemStore)pfn;    int a1 = 0;    _GUID a2 = { 478862213u, 38958u, 18425u,{ 153u, 159u, 176u, 195u, 191u, 157u, 4u, 73u } };    IUnknown *a3;    int result;    result = g_fnGetSystemStore(a1, &a2, vfptr);    //*vfptr = a3;#if _DEBUG    cout << "函数地址: " << hex << g_fnGetSystemStore << endl;    cout << "GetSystemStore error: " << GetLastError() << endl;    cout << "调用 GetSystemStore 结束" << endl;;    cout << endl;#endif // _DEBUG    return result;}调用：IUnknown *vfptr;GetSystemStore(&vfptr);printf("%p\n", vfptr);结果：__vfptr0x53073d7c {wcp.dll!const Windows::COM::CComObject<class Windows::WCP::COM::CCSIExternalTransformerExecutor>::`vftable'{for `ICSIExternalTransformerExecutor'}} {...}   void * *[0x00000000]    0x5313b520 {wcp.dll!Windows::COM::CComObject<class Windows::WCP::COM::CCSIExternalTransformerExecutor>::QueryInterface(struct _GUID const &,void * *)}  void *[0x00000001]    0x53125f10 {wcp.dll!Windows::COM::CComObject<class Windows::ServicingAPI::CCDFEnumeratorHelper<struct IEnumCDF_APPID_TABLE_ITEM,class Windows::Cdf::Rtl::IRtlCdfAppIdTableEnumerator,class Windows::Cdf::Rtl::IRtlCdfAppIdTable,struct _CDF_APPID_TABLE_ITEM,8> >::AddRef(void)}    void *[0x00000002]    0x531086e0 {wcp.dll!Windows::COM::CComObject<class Windows::ServicingAPI::CCDFEnumeratorHelper<struct IEnumCDF_APPID_TABLE_ITEM,class Windows::Cdf::Rtl::IRtlCdfAppIdTableEnumerator,class Windows::Cdf::Rtl::IRtlCdfAppIdTable,struct _CDF_APPID_TABLE_ITEM,8> >::Release(void)}   void *