其中
typedef struct ServiceDescriptorTable {
PVOID ServiceTableBase;
PVOID ServiceCounterTable(0);
unsigned int NumberOfServices;
PVOID ParamTableBase;
}

typedef NTSTATUS (*NTCREATEFILE)(
PHANDLE FileHandle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes,
PIO_STATUS_BLOCK IoStatusBlock,
PLARGE_INTEGER AllocationSize OPTIONAL,
ULONG FileAttributes,
ULONG ShareAccess,
ULONG CreateDisposition,
ULONG CreateOptions,
PVOID EaBuffer OPTIONAL,
ULONG EaLength
);

#define SYSTEMSERVICE(_function)

KeServiceDescriptorTable.ServiceTableBase[*(PULONG)((PUCHAR)_function+1)]

NTCREATEFILE OldNtCreateFile;

NTSTATUS HookServices()
{
OldNtCreateFile=(NTCREATEFILE)(SYSTEMSERVICE(ZwCreateFile));

_asm cli

(NTCREATEFILE)(SYSTEMSERVICE(ZwCreateFile))=NewNtCreateFile;

_asm sti

return STATUS_SUCCESS;
}

这个编译说
cannot convert from 'NTSTATUS (__stdcall *)(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PIO_STATUS_BLOCK,PVOID,ULONG,PLARGE_INTEGER,PULONG)' to 'ZWCREATEFILE'
还有一个，退出驱动时负回正确值时说这个语句
(ZWCREATEFILE)(SYSTEMSERVICE(ZwCreateFile)) = OldZwCreateFile;
error C2106: '=' : left operand must be l-value

[课程]Linux pwn 探索篇！