X86 下的SSDT HOOK

typedef struct _KSERVICE_TABLE_DESCRIPTOR {
    PULONG_PTR Base;
    PULONG Count;
    ULONG Limit;
    PUCHAR Number;
} KSERVICE_TABLE_DESCRIPTOR, *PKSERVICE_TABLE_DESCRIPTOR;

#include "Driver.h"

NTKERNELAPI UCHAR* PsGetProcessImageFileName(IN PEPROCESS Process);

void UnHook();
void DriverUnLoad(PDRIVER_OBJECT pDriverObj)
{
    UnHook();
    KdPrint(("驱动卸载成功"));
}

typedef struct _KSERVICE_TABLE_DESCRIPTOR {
    PULONG_PTR Base;
    PULONG Count;
    ULONG Limit;
    PUCHAR Number;
} KSERVICE_TABLE_DESCRIPTOR, *PKSERVICE_TABLE_DESCRIPTOR;

__declspec(dllimport) KSERVICE_TABLE_DESCRIPTOR KeServiceDescriptorTable; //导入全局变量

// sizeof(base) + 370 * 4 = NtTerMinateProcess

//extern KSERVICE_TABLE_DESCRIPTOR KeServiceDescriptorTable
typedef NTSTATUS(*PfnZwTerminateProcess)(
    IN HANDLE              ProcessHandle OPTIONAL,
    IN NTSTATUS            ExitStatus);

PfnZwTerminateProcess OldZwTerminateProcess;
NTSTATUS Hook_ZwTerminateProcess(
    IN HANDLE              ProcessHandle OPTIONAL,
    IN NTSTATUS            ExitStatus)
{
    NTSTATUS rc;
    PEPROCESS pRocess;
    UCHAR *pszProcessName;
    //UCHAR *pszProcessName = PsGetProcessImageFileName();
    rc = ObReferenceObjectByHandle(ProcessHandle, GENERIC_ALL, *PsProcessType, KernelMode, &pRocess, NULL);
    if (!NT_SUCCESS(rc))
    {
        
        return OldZwTerminateProcess(ProcessHandle, ExitStatus);
    }
    pszProcessName = PsGetProcessImageFileName(pRocess);
    if (strstr(pszProcessName, "calc"))
    {
        return STATUS_ACCESS_DENIED;
        ObDereferenceObject(pRocess);
    }
    ObDereferenceObject(pRocess);
    rc = OldZwTerminateProcess(ProcessHandle, ExitStatus);
    return rc;
}
//关闭写保护 1111 1111 1111 1110 1111 1111 1111 1111 
VOID _CloseWriteProtected()
{
    __asm
    {
        push eax
        mov eax, cr0
        and eax, 0xFFFEFFFF
        mov cr0,eax
        pop eax
    }
    return;
}
VOID _OpenTheWriteProtected()
{
    __asm
    {
        push    eax
        mov        eax, cr0
        or eax, NOT 0xFFFEFFFF
        mov        cr0, eax
        pop        eax
    }
    return;
}
void HOOK()
{
    //370是ntTerminateProcess 也可以写成 base + sizeof(type) *n = *(KeServiceDescriptorTable.Base) + 4 * 370 = NtTinminateProcess的地址
    /*
    OldZwTerminateProcess = (PfnZwTerminateProcess)(*(KeServiceDescriptorTable.Base) + 370 * 4);
    */
    OldZwTerminateProcess = (PfnZwTerminateProcess)KeServiceDescriptorTable.Base[370];
    _CloseWriteProtected();
    //
    KeServiceDescriptorTable.Base[370] = (int)Hook_ZwTerminateProcess;

    _OpenTheWriteProtected();
}
void UnHook()
{
    _CloseWriteProtected();
    //
    KeServiceDescriptorTable.Base[370] = (int)OldZwTerminateProcess;

    _OpenTheWriteProtected();
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObj, PUNICODE_STRING pRegPath)
{
    
    pDriverObj->DriverUnload = DriverUnLoad;
    
    HOOK();
    return STATUS_SUCCESS;
}

未测试.
KeServiceDescriptorTable.Base[*(PULONG)((PUCHAR)_FUNCTION +1)];