HOOK SERVICE TABLE ERROR!

//下面是undocument windows nt中的一段代码
#define SYSTEMSERVICE(_function)  KeServiceDescriptorTable.ServiceTableBase[ *(PULONG)((PUCHAR)_function+1)]
OldNtCreateFile=(NTCREATEFILE)(SYSTEMSERVICE(ZwCreateFile));
//上面这句没错
_asm cli
//HOOK FUNCTION
(NTCREATEFILE)(SYSTEMSERVICE(ZwCreateFile))=NewNtCreateFile;
//这句就错了
,错误为\" \'=\' : left operand must be l-value\"
于是改为SYSTEMSERVICE(ZwCreateFile)=(unsigned int)NewNtCreateFile
还是错,错误为error LNK2001: unresolved external symbol \"__declspec(dllimport
) struct ServiceDescriptorEntry  KeServiceDescriptorTable\" (__imp_?KeServiceDesc
riptorTable@@3UServiceDescriptorEntry@@A)
不知道各位高手有无解决办法?

NTSTATUS HookServices()
{
        OldNtCreateFile=(NTCREATEFILE)(SYSTEMSERVICE(ZwCreateFile));
        _asm cli
        (NTCREATEFILE)(SYSTEMSERVICE(ZwCreateFile))=NewNtCreateFile;
        _asm sti
        return STATUS_SUCCESS;
}

void UnHookServices()
{
        _asm cli
        (NTCREATEFILE)(SYSTEMSERVICE(ZwCreateFile))=OldNtCreateFile;
        _asm sti
        return;
}
UNDODNT的代码没有什么问题，可以正常编译的，检查你自己的编译设置，别把库连接到NTDLL。DLL里去了。

我是hook的ZwQueryDirectoryFile
typedef NTSTATUS (*TRUEZWQUERYDIRECTORYFILE)(
IN HANDLE hFile,
IN HANDLE hEvent OPTIONAL,
IN PIO_APC_ROUTINE IoApcRoutine OPTIONAL,
IN PVOID IoApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK pIoStatusBlock,
OUT PVOID FileInformationBuffer,
IN ULONG FileInformationBufferLength,
IN PFILE_INFORMATION_CLASS FileInfoClass,
IN BOOLEAN bReturnOnlyOneEntry,
IN PUNICODE_STRING PashMask OPTIONAL,
IN BOOLEAN bRestartQuery);

(TRUEZWQUERYDIRECTORYFILE)((SYSTEMSERVICE(ZwQueryDirectoryFile))=HookZwQueryDirectoryFile;
这一句就 error C2106: \'=\' : left operand must be l-value
什么错误?

把这个加在头文件里

#pragma pack(1)
typedef struct ServiceDescriptorEntry {
unsigned int *ServiceTableBase;
unsigned int *ServiceCounterTableBase; //Used only in checked build
unsigned int NumberOfServices;
unsigned char *ParamTableBase;
} ServiceDescriptorTableEntry_t, *PServiceDescriptorTableEntry_t;
#pragma pack()

__declspec(dllimport)  ServiceDescriptorTableEntry_t KeServiceDescriptorTable;

我加了那一句还是不行拉,
谁能告诉我error C2106: \'=\' : left operand must be l-value
到底是什么错误吗?

我也遇到这个问题了，并且说我的SYSTEMSERVICE没有定义！！！