NTSTATUS ReplaceServiceTableOfThread(PKTHREAD PTragetThread){
if(0 == SDIF){
return STATUS_UNSUCCESSFUL;
}
PULONG* PServiceTable = (PULONG*)((PUCHAR)PTragetThread + KTDelta_ServiceTable);
*PServiceTable = (PULONG)PMySSDTBuffer;
return STATUS_SUCCESS;
}
轻松绕开SSDT HOOK[s:274]
