#include <windows.h>
#include <list>
#include <algorithm>
void ShowTest(int num)
{
     printf("%d ", num);
}
void testlist()
{
std::list<int> ttt;

ttt.push_back(123);
ttt.push_back(456);
ttt.push_back(789);
ttt.push_back(124);
ttt.push_back(445);

for_each(ttt.begin(), ttt.end(), ShowTest);
ttt.sort();
for_each(ttt.begin(), ttt.end(), ShowTest);

return ;
}

void main()
{
testlist();
}

NTSTATUS 
Hooked_NtClose(	IN HANDLE Handle)
{
	NTSTATUS status;
	PVOID  pObject = NULL;

	if(!bInBlackListByEProcess(PsGetCurrentProcess()))	//不是黑名单
		return ((pfnNtClose)fiNtClose.uRealAddr)(Handle);

	if(NT_SUCCESS(ObReferenceObjectByHandle(Handle, GENERIC_READ, 0, KernelMode, &pObject, NULL)))
	{
		ObDereferenceObject(pObject);
		status = ((pfnNtClose)fiNtClose.uRealAddr)(Handle);
	}
	else
	{
		status = STATUS_INVALID_HANDLE;
	}
	return status;
}