最近试着用汇编写个驱动，遇到个问题想向大家请教：
我只是想简单地弄个SSDT HOOK，试着写个驱动，但是驱动加载约5秒就蓝屏。。。。
蓝屏的信息是：
IRQL_NOT_LESS_OR_EQUAL
STOP：0x0000000A
(0xFFC3F82A,0x00000002,0x00000000,0x804DEC7B)后面括号里的4个地址会变。
机子用WinXPSP3，装ESET NOD32，并没有冲突。
代码在下面，编译好的驱动放在附件里了，不知道哪里出错了，谢谢。
.386
.model flat,stdcall
option casemap:none
include ntddk.inc
include ntstatus.inc
include ntoskrnl.inc
includelib ntoskrnl.lib
include Strings.mac
.data?
OldZwQueryDirectoryFile dd ?
.code
DriverEntry proc pDriverObject:PDRIVER_OBJECT,pusRegistryPath:PUNICODE_STRING
LOCAL pDeviceObject:PVOID
LOCAL Status:NTSTATUS
mov eax,STATUS_DEVICE_CONFIGURATION_ERROR
mov Status,eax
pushad
mov eax,pDriverObject
assume eax:ptr DRIVER_OBJECT
mov [eax].DriverUnload,offset DriverUnload
assume eax:nothing
mov edi,KeServiceDescriptorTable
mov edi,[edi]
mov eax,[edi+(091h*4)]
mov OldZwQueryDirectoryFile,eax
cli
mov eax,CR0
and eax,not 10000h
mov CR0,eax
mov [edi+(091h*4)],dword ptr offset NewZwQueryDirectoryFile
mov eax,CR0
or eax,10000h
mov CR0,eax
sti
mov Status,STATUS_SUCCESS
popad
mov eax,Status
ret
DriverEntry endp
DriverUnload proc pDRIVER_OBJECT:PDRIVER_OBJECT
pushad
mov edi,KeServiceDescriptorTable
mov edi,[edi]
cli
mov eax,CR0
and eax,not 10000h
mov CR0,eax
mov eax,dword ptr OldZwQueryDirectoryFile
mov [edi+(091h*4)],eax
mov eax,CR0
or eax,10000h
mov CR0,eax
sti
popad
ret
DriverUnload endp
NewZwQueryDirectoryFile proc
jmp dword ptr OldZwQueryDirectoryFile
ret
NewZwQueryDirectoryFile endp
end DriverEntry
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
