更加稳定的HOOK SSDT(通过MDL方式)

传说修改cr0寄存器后再写SSDT在多核CPU不稳定,因此提供一个更加稳定的写SSDT表的方式,代码如下

//
//  挂钩函数
//
BOOL HookSSDT()
... {
    PMDL pMdlSystemCall = NULL;
    DWORD * MappedSystemCallTable = 0;
       pMdlSystemCall = IoAllocateMdl(
                                   KeServiceDescriptorTable->ntoskrnl.ServiceTable,
                                   KeServiceDescriptorTable->ntoskrnl.CounterTable*4, 
                                   0,
                                   0,
                                   NULL
                                   );
       if(!pMdlSystemCall)
          return FALSE;

       MmBuildMdlForNonPagedPool(pMdlSystemCall);