UCHAR CodeBuff[10];
	status = ZwQuerySystemInformation(SystemModuleInformation,NULL,0,&length);
	if (status == STATUS_INFO_LENGTH_MISMATCH)
	{
  		SysInfo = ExAllocatePool(NonPagedPool,length);
  		if (NULL == SysInfo)
  		{
  			return;
  		}
	}
	status = ZwQuerySystemInformation(SystemModuleInformation,SysInfo,length,&length);
	pSmi = (PSYSTEM_MODULE_INFORMATION)((char*)SysInfo+4);
	kBase = (ULONG)(pSmi->Base);
	kSize = (ULONG)(pSmi->Size);


	InitializeObjectAttributes (
		&ob,
		&pdte->FullDllName,
		OBJ_CASE_INSENSITIVE,
		NULL,
		NULL
		);
	status = ZwOpenFile(
		&hFile,
		FILE_READ_ACCESS,
		&ob,
		&IoStatusBlock,
		FILE_SHARE_READ,
		FILE_SYNCHRONOUS_IO_NONALERT
       );
	ob.ObjectName = NULL;
	status =  ZwCreateSection(
		&hSection,
		SECTION_MAP_EXECUTE,
		&ob,
		0,
		PAGE_EXECUTE,
		SEC_IMAGE,
		hFile
		);
	size = 0;
	status =  ZwMapViewOfSection(
			hSection,
			NtCurrentProcess(),
			&BaseAddress,
			0, 
			1000, 
			0, 
			&size, 
			(SECTION_INHERIT)1, 
			MEM_TOP_DOWN, 
			PAGE_READWRITE
			);
	mBase = ExAllocatePool (NonPagedPool, size);

	RtlCopyMemory (mBase, BaseAddress, size);		
		
	DosHead = (PIMAGE_DOS_HEADER)mBase;
	NtHeads = (PIMAGE_NT_HEADERS)((ULONG)DosHead + DosHead->e_lfanew);
	ExportDir = (PIMAGE_EXPORT_DIRECTORY)((PUCHAR)mBase + NtHeads->OptionalHeader.DataDirectory[0].VirtualAddress);
	RelocDir = (PIMAGE_BASE_RELOCATION)((ULONG)mBase + NtHeads->OptionalHeader.DataDirectory[5].VirtualAddress);
	Name = mBase + ExportDir->AddressOfNames;
	Ordinal = mBase + ExportDir->AddressOfNameOrdinals;
	Function = mBase + ExportDir->AddressOfFunctions;

	if (RelocDir != NULL)
	{
		while (RelocDir->VirtualAddress != 0 || RelocDir->SizeOfBlock !=  0)
		{
			FixAddrBase = RelocDir->VirtualAddress + (ULONG)mBase;
			RelocSize = (RelocDir->SizeOfBlock - 8)/2;
			for ( i = 0; i < RelocSize; i++)
			{
				Temp = *(PUSHORT)((ULONG)RelocDir + sizeof (IMAGE_BASE_RELOCATION) + i * 2);
				if ( (Temp & 0xF000) == 0x3000)
				{
					Temp &= 0x0FFF;
					FixAddr = FixAddrBase + (ULONG)Temp;
					*(PULONG)FixAddr = *(PULONG)FixAddr + (ULONG)kBase - (ULONG)NtHeads->OptionalHeader.ImageBase;
				}
			}
			RelocDir = (ULONG)RelocDir + RelocDir->SizeOfBlock;
		}
	}



	for (i = 0; i < ExportDir->NumberOfNames; i++)
	{
		SystemFunName = (PCHAR)(*(PULONG)(Name + i * 4) + (ULONG)Base);
		index = *((PUSHORT)(Ordinal + i * 2));
		Address = *((PULONG)(Function + index * 4));
		if (Flag == 0)
		{
			if (!stricmp ("NtOpenProcess", SystemFunName))
			{
				break;
			}
		}
	}
  
	memcopy (CodeBuff, Address + mBase, 10);
	//到这里就获得了原始ntopenprocess函数开头10字节代码

	MyNtOpenProcessAdddress = MyNtProcessBorn (CodeBuff);

	//好了，什么都有了，ssdthook就ok了

 ULONG  MyNtProcessBorn (PUCHAR CodeBuff)
 {
	 PUCHAR Temp;
	 ULONG myntopenprocessaddress;
	 myntopenprocessaddress = ExAllocatePool (NonPagedPool, 15);
	 memcpy (myntprocessaddress, CodeBuff, 10);

	 Temp = (PUCHAR)myntprocessaddress + 10;
	 *(PUCHAR)Temp = 0xE9;
	 Temp += 1;
	 offset = (ULONG)realntopenprocessaddress - (ULONG)Temp - 4;

	 *(PULONG)Temp = offset;
	 return myntopenprocessaddress;

 }