一段获取ssdt表及其中函数的简单代码

一段获取ssdt表及其中函数的简单代码

typedef struct _SYSTEM_SERVICE_TABLE
{
    PNTPROC    ServiceTable ;    // array of entry points
    PULONG    CounterTable ;    // array of usage counters . be NULL
    ULONG    ServiceLimit ;    // number of table entries
    UCHAR*    ArgumentTable ;    // array of bytes counts
} SYSTEM_SERVICE_TABLE , *PSYSTEM_SERVICE_TABLE , **PPSYSTEM_SERVICE_TABLE ;

ULONG GetSSDTFunction(ULONG nIndex, ULONG *pFunAddr )
{
      PETHREAD kthread;
      PSYSTEM_SERVICE_TABLE   pssdt;

      kthread = (ULONG)PsGetCurrentThread();
      pssdt = kthread ->ServiceTable;
     
       if( nIndex < pssdt->ServiceLimit )
       {
              *pFunAddr = pssdt->ServiceTable [nIndex];
              return   *pFunAddr;
       }

       return   0;

}