一个禁止任何ring3调试的驱动

#include <ntddk.h>

#define MAKELONG(low, high) \
((ULONG)(((USHORT)((ULONG)(low) & 0xffff)) | ((ULONG)((USHORT)((ULONG)(high) & 0xffff))) << 16))

#define GET_LOW16_OF_32(data) \
((USHORT)(((ULONG)data) & 0xffff))

#define GET_HIGH16_OF_32(data) \
((USHORT)(((ULONG)data) >> 16))

#pragma pack(push,1)
typedef struct IDTR_
{
  USHORT limit;
  ULONG base;
} IDTR, *P_IDTR;

typedef struct IDTENTRY_
{
  USHORT offset_low;
  USHORT selector;
  UCHAR reserved;
  UCHAR type:4;
  UCHAR always0:1;
  UCHAR dpl:2;
  UCHAR present:1;
  USHORT offset_high;
} IDTENTRY, *P_IDTENTRY;
#pragma pack(pop)

ULONG Offset = 0;
ULONG HOOK_IDT_INDEX[] = {0x01, 0x03};
#define HOOK_IDT_NUM sizeof(HOOK_IDT_INDEX)/sizeof(ULONG)
VOID *g_old_entry[HOOK_IDT_NUM] = {0};

VOID *GetIdt()
{
  IDTR idtr;
  _asm sidt idtr
  return (VOID *)idtr.base;
}

VOID MyUserFilter()
{
  KdPrint(("Crurrent IRQL: %d\n",KeGetCurrentIrql()));
  if (Offset &