gistfile1.cpp

void Hook()
{
    while (TRUE)
    {
        PsCreateSystemThread(&hThread, (ACCESS_MASK)0L, NULL, NULL, NULL,
            (PKSTART_ROUTINE)HookInt2E, NULL);
        KeWaitForSingleObject(&syncEvent, Executive, KernelMode, FALSE, NULL);
        if (nIDTHooked == nProcessors)
            break;
    }
}

void HookInt2E()
{
    DWORD dwISRAddress;

    KdPrint(("[HookInt2E]\n"));

    dwISRAddress = makeDWORD(idt2e->offset16_31, idt2e->offset00_15);
    if (dwISRAddress == (DWORD)KiSystemServiceHook)
    {
        KdPrint(("Processor[%d] is hooked already\n",
            KeGetCurrentProcessorNumber()));
        KeSetEvent(&syncEvent, 0, FALSE);
        PsTerminateSystemThread(STATUS_SUCCESS);
    }

    __asm
    {
        cli;
        lea eax, KiSystemServiceHook;
        mov ebx, idt2e;

        mov [ebx], ax;
        shr eax, 16;
        mov [ebx+6], ax;
        sti;
    }
    KdPrint(("Processor[%d] is hooked\n", KeGetCurrentProcessorNumber()));
    InterlockedIncrement(&nIDTHooked);
    KeSetEvent(&syncEvent, 0, FALSE);
    PsTerminateSystemThread(STATUS_SUCCESS);
}