#define SYSTEMSERVICE(_function)  KeServiceDescriptorTable.ServiceTableBase[ *(PULONG)((PUCHAR)_function+1)]
//...
RealZwWriteFile = (ZWWRITEFILE)(SYSTEMSERVICE(ZwWriteFile));
_asm {
                cli
                mov  eax,cr0   
                and  eax,not 10000h
                mov  cr0,eax
}
(SYSTEMSERVICE(ZwWriteFile)) = (ULONG)HookZwWriteFile;
//还原内存写保护 省略
//...
NTSTATUS
HookZwWriteFile(
IN HANDLE FileHandle,
IN HANDLE Event OPTIONAL,
IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
IN PVOID ApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK IoStatusBlock,
IN PVOID Buffer,
IN ULONG Length,
IN PLARGE_INTEGER ByteOffset OPTIONAL,
IN PULONG Key OPTIONAL
)
{
        KdPrint(("Enter Hook\n"));
       
                   return RealZwWriteFile(
           FileHandle,
           Event OPTIONAL,
           ApcRoutine OPTIONAL,
           ApcContext OPTIONAL,
           IoStatusBlock,
           Buffer,
           Length,
           ByteOffset OPTIONAL,
           Key OPTIONAL
           );
}
加载驱动以后，没有输出“Enter Hook”，请问问题在什么地方？

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！