绕过SSDT驱动保护

       A、去掉页面保护

       B、写入In Line HOOK代码

       C、用OD附加测试效果

       D、反HOOK代码

cr0,32位寄存器 MDL

17位CW，1开启页面保护 置0 去掉页面

 not (1 shl 16)= 0FFFEFFFFh

10000000000000000

#pragma pack(1)

#pragma pack()

 __asm //去掉页面保护

                  {

                           cli

                           mov eax,cr0

                           and eax,not 10000h //and eax,0FFFEFFFFh

                           mov cr0,eax

 

                  }

 __asm //恢复页保护

                   {

                           mov eax,cr0

                           or  eax,10000h //or eax,not 0FFFEFFFFh

                           mov cr0,eax

                           sti

                   }