#ifdef __cplusplus

 extern "C"

 {

 #endif

 #include <ntddk.h>

 #ifdef __cplusplus

 }

 #endif

 typedef struct _ServiceDescriptorTable {

     unsigned int *ServiceTableBase; //System Service Dispatch Table 的基地址

     unsigned int *ServiceCounterTable;

     //包含着 SSDT 中每个服务被调用次数的计数器。这个计数器一般由sysenter 更新。

     unsigned int NumberOfServices;//由 ServiceTableBase 描述的服务的数目。

     unsigned int *ParamTableBase; //包含每个系统服务参数字节数表的基地址-系统服务参数表

 }*PServiceDescriptorTable;  

 extern "C" extern PServiceDescriptorTable KeServiceDescriptorTable;

 typedef NTSTATUS (*NTCREATEPROCESSEX)(PHANDLE ProcessHandle,

     ACCESS_MASK DesiredAccess,

     POBJECT_ATTRIBUTES oa,

     HANDLE ParentProcess,

     ULONG Flags,

     HANDLE SectionHandle,

     HANDLE DebugPort,

     HANDLE ExceptionPort,

     ULONG JobFlag);

 ULONG O_NtCreateProcesseEx = ;    // 保存原始地址

 // 去掉页面保护

 VOID UN_PROTECT()

 {

     __asm

     {

         cli    //关闭中断，增强这段代码的稳定性

         push eax

         mov eax, CR0

         and eax, 0x0FFFEFFFF //使低17位为0   从右往左第17位

         mov CR0, eax

         pop eax

     }

 }

 // 恢复页面保护

 VOID RE_PROTECT()

 {

     __asm

     {

             push eax

             mov eax, CR0

             or  eax,10000h //使低17位为1

             mov CR0, eax

             pop eax

             sti    //打开中断

     }

 }

 //自己定义的函数，让程序执行的函数

 NTSTATUS

 MyNtCreateProcessEx(

     PHANDLE ProcessHandle,

     ACCESS_MASK DesiredAccess,

     POBJECT_ATTRIBUTES oa,

     HANDLE ParentProcess,

     ULONG Flags,

     HANDLE SectionHandle,

     HANDLE DebugPort,

     HANDLE ExceptionPort,

     ULONG JobFlag)

 {

     KdPrint(("Hook NtCreateProcess Success\n"));

     // 调用NtCreateProcessEx函数，为什么能够调用？因为地址因为替换成NtCreateProcessEx函数的地址

     // 3 正常返回

     return ((NTCREATEPROCESSEX)O_NtCreateProcesseEx)(ProcessHandle,

                         DesiredAccess,

                         oa,

                         ParentProcess,

                         Flags,

                         SectionHandle,

                         DebugPort,

                         ExceptionPort,

                         JobFlag);

 }

 VOID HookSsdt()

 {

     //1 保存

     O_NtCreateProcesseEx = KeServiceDescriptorTable->ServiceTableBase[];

     UN_PROTECT();

     // 2 替换

     KeServiceDescriptorTable->ServiceTableBase[] = (unsigned int )MyNtCreateProcessEx;

     RE_PROTECT();

 }

 VOID UnHookSsdt()

 {

     // 4 替换回去

     KeServiceDescriptorTable->ServiceTableBase[] = O_NtCreateProcesseEx;

 }

 VOID DriverUnload(PDRIVER_OBJECT pDriverObject)

 {

     UnHookSsdt();

     KdPrint(("Driver Unload Success\n"));

 }

 extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath)

 {

     KdPrint(("Welcome to JoyChou's Driver\n"));

     pDriverObject->DriverUnload = DriverUnload;

     HookSsdt();

     return STATUS_SUCCESS;

 }