这边附上一段代码：
DWORD AddService(DWORD dwZwOpenProcessID)
{
        DWORD dwOldWriteAttribute;
        UCHAR *pArgumentTable;
        DWORD *pServiceTable;
        UCHAR *pArgumentTable0;
        DWORD *pServiceTable0;
        const PSYSTEM_SERVICE_TABLE pSSDTShadow = g_pKeServiceDescriptorTableShadow;

        g_bIsAlreadyAddService = TRUE;
       
        //        nCount = pTmpSSDT[1].ServiceLimit;
        pArgumentTable = (UCHAR*)pSSDTShadow[1].ArgumentTable;
        pServiceTable = (DWORD*)pSSDTShadow[1].ServiceTable;
        pArgumentTable0 = (UCHAR*)pSSDTShadow[0].ArgumentTable;
        pServiceTable0 = (DWORD*)pSSDTShadow[0].ServiceTable;

        DisableWriteProtect(&dwOldWriteAttribute);
//        _asm cli

        //添加ZwOpenProcess的Service
        pArgumentTable0[pSSDTShadow[0].ServiceLimit] = pArgumentTable0[dwZwOpenProcessID);
        pServiceTable0[pSSDTShadow[0].ServiceLimit] = pServiceTable0[dwZwOpenProcessID)];
        pServiceTable0[pSSDTShadow[0].ServiceLimit] = (DWORD)MyOpenProcess;

        KeServiceDescriptorTable->ServiceLimit++;
        pSSDTShadow[0].ServiceLimit++;

//        _asm sti
        EnableWriteProtect(dwOldWriteAttribute);
       
        return pSSDTShadow[0].ServiceLimit;
}

同问
我最近也遇到过这个问题  
猜测是不是高IRQL下遇到分页错误导致的

档案已存在，太强大了

不懂。为什么不用 KeAddSystemServiceTable?

同问
我最近也遇到过这个问题
猜测是不是高IRQL下遇到分页错误导致的

意思是KeServiceDescriptorTable所指的内存是属于分页内存？
导致在高于DISPATCH_LEVEL的IRQL下发生系统崩溃？

不懂。为什么不用 KeAddSystemServiceTable?

没有找到  KeAddSystemServiceTable 的具体资料。不知道参数是哪些。

wrk之``````````````

BOOLEAN
KeAddSystemServiceTable (
IN PULONG_PTR Base,
IN PULONG Count OPTIONAL,
IN ULONG Limit,
IN PUCHAR Number,
IN ULONG Index
)

/*++

Routine Description:

This function adds the specified system service table to the system.

Arguments:

Base - Supplies the address of the system service table dispatch table.

Count - Supplies an optional pointer to a table of per system service
counters.

Limit - Supplies the limit of the service table. Services greater
than or equal to this limit will fail.

Arguments - Supplies the address of the argument count table.

Index - Supplies index of the service table.

Return Value:

TRUE - The operation was successful.

FALSE - the operation failed. A service table is already bound to
the specified location, or the specified index is larger than
the maximum allowed index.

--*/

{

PAGED_CODE();

//
// If a system service table is already defined for the specified
// index, then return FALSE. Otherwise, establish the new system
// service table.
//

if ((Index > NUMBER_SERVICE_TABLES - 1) ||
(KeServiceDescriptorTable[Index].Base != NULL) ||
(KeServiceDescriptorTableShadow[Index].Base != NULL)) {

return FALSE;

} else {

//
// If the service table index is equal to the Win32 table, then
// only update the shadow system service table. Otherwise, both
// the shadow and static system service tables are updated.
//

KeServiceDescriptorTableShadow[Index].Base = Base;
KeServiceDescriptorTableShadow[Index].Count = Count;
KeServiceDescriptorTableShadow[Index].Limit = Limit;
KeServiceDescriptorTableShadow[Index].Number = Number;
if (Index != WIN32K_SERVICE_INDEX) {
KeServiceDescriptorTable[Index].Base = Base;
KeServiceDescriptorTable[Index].Count = Count;
KeServiceDescriptorTable[Index].Limit = Limit;
KeServiceDescriptorTable[Index].Number = Number;
}

return TRUE;
}
}

BOOLEAN
KeRemoveSystemServiceTable (
IN ULONG Index
)

/*++

Routine Description:

This function removes a system service table from the system.

Arguments:

Index - Supplies index of the service table.

Return Value:

TRUE - The operation was successful.

FALSE - the operation failed. A service table is is not bound or is illegal to remove

--*/

{

PAGED_CODE();

if ((Index > NUMBER_SERVICE_TABLES - 1) ||
((KeServiceDescriptorTable[Index].Base == NULL) &&
(KeServiceDescriptorTableShadow[Index].Base == NULL))) {

return FALSE;

} else {
KeServiceDescriptorTableShadow[Index].Base = NULL;
KeServiceDescriptorTableShadow[Index].Count = 0;
KeServiceDescriptorTableShadow[Index].Limit = 0;
KeServiceDescriptorTableShadow[Index].Number = 0;
if (Index != WIN32K_SERVICE_INDEX) {
KeServiceDescriptorTable[Index].Base = NULL;
KeServiceDescriptorTable[Index].Count = 0;
KeServiceDescriptorTable[Index].Limit = 0;
KeServiceDescriptorTable[Index].Number = 0;
}

return TRUE;
}
}

不是楼主想做的事

好像是吧？`````

这个函数是往系统中添加一个SystemServiceTable，而我是想在某个指定的SystemServiceTable表中（比如KeServiceDescriptorTableShadow[0]这个表中）添加一个服务函数。不知道有没什么好的解决办法。

楼主就是想象卡巴那样自己添加系统服务~

卡巴倒是没去看过，至少金山的是这么做的。

杀毒软件和Rootkit看起来没什么分别