title: Hook ZwTerminateProcess in x64 Driver (Without SSDT)
body: <p>I found and read this question but I didn't found my answer <a href="https://stackoverflow.com/questions/11597888/ssdt-hooking-alternative-in-x64-systems"><strong>SSDT hooking alternative in x64 systems</strong></a></p>
  <p>I want to protect my application against termination by other programs. In the 32Bit version of windows I used the <code>SSDT hooking</code> for hooking <code>ZwTerminateProcess</code> or <code>ZwOpenProcess</code>. I've to upgrade my program to using in 64Bit version of windows now.
  And unfortunately in the 64bit windows we can't use <code>SSDT</code> hook (<a href="http://msdn.microsoft.com/en-us/windows/hardware/gg487353.aspx" rel="nofollow noreferrer"><strong>Because Patch Guard (KPP)</strong></a>), Notice that I don't want to Bypassing PG in this case and I've to use only kernel-mode hooking. For example, I don't want to my program begin terminated (Even )by the following code :</p>
  <pre><code>NTSTATUS drvTerminateProcess( ULONG ulProcessID )
  {
      NTSTATUS          ntStatus = STATUS_SUCCESS;
      HANDLE            hProcess;
      OBJECT_ATTRIBUTES ObjectAttributes;
      CLIENT_ID         ClientId;
  
      DbgPrint( &quot;drvTerminateProcess( %u )&quot;, ulProcessID );
  
      InitializeObjectAttributes( &amp;ObjectAttributes, NULL, OBJ_INHERIT, NULL, NULL ); 
  
      ClientId.UniqueProcess = (HANDLE)ulProcessID;
      ClientId.UniqueThread  = NULL;
  
      __try
      {
          ntStatus = ZwOpenProcess( &amp;hProcess, PROCESS_ALL_ACCESS, &amp;ObjectAttributes, &amp;ClientId );
          if( NT_SUCCESS(ntStatus) )
          {
              ntStatus = ZwTerminateProcess( hProcess, 0 );
              if( !NT_SUCCESS(ntStatus) )
                  DbgPrint( &quot;ZwTerminateProcess failed with status : %08X\n&quot;, ntStatus );
  
              ZwClose( hProcess );
          }
          else
              DbgPrint( &quot;ZwOpenProcess failed with status : %08X\n&quot;, ntStatus );
      }
      __except( EXCEPTION_EXECUTE_HANDLER )
      {
          ntStatus = STATUS_UNSUCCESSFUL;
          DbgPrint( &quot;Exception caught in drvTerminateProcess()&quot; );
      }
  
      return ntStatus;
  }
  </code></pre>
  <p>To do this work I used the following function (<code>NewZwOpenProcess</code>) and replace it with the original <code>ZwOpenProcess</code>  in SSDT but in x64 windows I don't know what should I do :( :</p>
  <pre><code>NTSTATUS NewZwOpenProcess(
          OUT PHANDLE ProcessHandle,
          IN ACCESS_MASK DesiredAccess,
          IN POBJECT_ATTRIBUTES ObjectAttributes,
          IN PCLIENT_ID ClientId OPTIONAL)
  {
          HANDLE ProcessId;
  
      __try 
      {
              ProcessId = ClientId-&gt;UniqueProcess;
      }
      __except(EXCEPTION_EXECUTE_HANDLER)
      {
         return STATUS_INVALID_PARAMETER;
      }
     
     if (ProcessId == (HANDLE)11) //Check if the PID matches our protected process PID (My programm)
      {
       return STATUS_ACCESS_DENIED; 
      }
    else 
      return OldZwOpenProcess(ProcessHandle, DesiredAccess,ObjectAttributes, ClientId);
  }
  </code></pre>
  <p>Any idea ??</p>
  <p>(Excuse me if my English is bad )</p>