#include <ntddk.h>

#define DWORD unsigned long

unsigned char OldCode[5]="\x68\xc4\x00\x00\x00";
unsigned char OldCode2[5]="\x8b\xff\x55\x8b\xec";

#pragma pack(1)
typedef struct ServiceDescriptorEntry {
 unsigned int *ServiceTableBase;
 unsigned int *ServiceCounterTableBase;
 unsigned int NumberOfServices;
 unsigned char *ParamTableBase;
} ServiceDescriptorTableEntry_t, *PServiceDescriptorTableEntry_t;
#pragma pack()

__declspec(dllimport) ServiceDescriptorTableEntry_t KeServiceDescriptorTable;

NTSTATUS DriverEntry( IN PDRIVER_OBJECT theDriverObject, IN PUNICODE_STRING theRegistryPath )
{
 DWORD OpAddr,OpAddr2;

 OpAddr=*(KeServiceDescriptorTable.ServiceTableBase + 0x7A);
 OpAddr2=*(KeServiceDescriptorTable.ServiceTableBase + 0x101);

 _asm
 {
 CLI
 MOV eax, CR0
 AND eax, NOT 10000H
 MOV CR0, eax

 pushad
 mov edi, OpAddr
 mov eax, dword ptr OldCode[0]
 mov [edi], eax
 mov al, byte ptr OldCode[4]
 mov [edi+4], al
 mov edi, OpAddr2
 mov eax, dword ptr OldCode2[0]
 mov [edi], eax
 mov al, byte ptr OldCode2[4]
 mov [edi+4], al
 popad

 MOV eax, CR0
 OR eax, 10000H
 MOV CR0, eax
 STI
 }
 
 return STATUS_SUCCESS;
}