SST Hook -> Bluescreen!?

[goggles99]

Yes, the "System Desciptor Table" in xp is write protected...
you need to disable the WP bit in the processors CR0 register.

Hooking by modifying the "Kernel service table" is used by several publicly available rootkit packages. HE4Hook and KApiHooks are two of them...

I can't download your attachment (Not enough thankyou points or something) but trysomething like this...

_asm
{
CLI //dissable interrupt
MOV EAX, CR0 //move CR0 register into EAX
AND EAX, NOT 10000H //disable WP bit 
MOV CR0, EAX //write register back
}

(NTCREATEFILE)(SYSTEMSERVICE(ZwCreateFile)) = NewZwCreateFile; // <---#HERE#

_asm 
{
MOV EAX, CR0 //move CR0 register into EAX
OR EAX, 10000H //enable WP bit 
MOV CR0, EAX //write register back 
STI //enable interrupt
}