可重用函数：挂接SSDT的函数

/**
*描述:
*    hook SSDT,用fnHooker挂接SSDT表中服务ID为sid的函数
*参数：
*    sid：要挂接的函数的服务ID
*    fnHooker:过滤函数
*返回：被挂接函数的真实地址
*
 */

ULONG PPHookSSDT(ULONG sid , PVOID fnHooker)
{
 PULONG pRealAddr = (PULONG)((ULONG)KeServiceDescriptorTable->ServiceTableBase + 4*sid)
 ULONG  realAddr = *pRealAddr;
 //去掉内存保护
 __asm
 {
    push eax
    cli
    mov  eax,cr0
    and  eax,not 10000h
    mov  cr0,eax
    pop eax
 }

 InterlockedExchange((LONG *)pRealAddr , (LONG)fnHooker);

 //恢复内存保护 
 __asm
 
 { 
    push eax
    mov  eax,cr0
    or   eax,10000h
    mov  cr0,eax
    sti
    pop  eax
 }
return realAddr;
}