最近学习rootkit遇到点问题，还望高人指点指点。
我在Hook NtCreateThread的时候，编译老提示未导入ZwCreateThread,我知道ZwCreateThread是未导出的函数，因此在头文件中自己声明了一个，不过编译还是报。郁闷啊。
部分代码：
//定义服务描述表
typedef struct ServiceDescriptorEntry {
        unsigned int *ServiceTableBase;
        unsigned int *ServiceCounterTableBase;
        unsigned int NumberOfServices;
        unsigned char *ParamTableBase;
} ServiceDescriptorTableEntry, *PServiceDescriptorTableEntry;

extern PServiceDescriptorTableEntry KeServiceDescriptorTable;

#define SYSCALL(_function) KeServiceDescriptorTable->ServiceTableBase[*(PULONG)((PUCHAR)_function+1)]

//ZwCreateThread
NTSYSAPI
NTSTATUS
NTAPI
ZwCreateThread
(
OUT PHANDLE ThreadHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN HANDLE ProcessHandle,
OUT PCLIENT_ID ClientId,
IN PCONTEXT ThreadContext,
IN PUSER_STACK UserStack,
IN BOOLEAN CreateSuspended
);
typedef NTSTATUS (*ZWCREATETHREAD)
(
OUT PHANDLE ThreadHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN HANDLE ProcessHandle,
OUT PCLIENT_ID ClientId,
IN PCONTEXT ThreadContext,
IN PUSER_STACK UserStack,
IN BOOLEAN CreateSuspended
);
ZWCREATETHREAD OldZwCreateThread;

NTSTATUS HookZwCreateThread
(
OUT PHANDLE ThreadHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN HANDLE ProcessHandle,
OUT PCLIENT_ID ClientId,
IN PCONTEXT ThreadContext,
IN PUSER_STACK UserStack,
IN BOOLEAN CreateSuspended
);
HookInjectOn()
{
        DbgPrint("HookInjectOn");
        OldZwCreateThread = (ZWCREATETHREAD)(SYSCALL(ZwCreateThread));
        _asm
        {
                CLI
                        MOV EAX,CR0
                        AND EAX,NOT  10000H
                        MOV CR0,EAX
        }
        (ZWCREATETHREAD)(SYSCALL(ZwCreateThread)) = HookZwCreateThread;
        _asm
        {
                MOV EAX,CR0
                        OR EAX,10000H
                        MOV CR0,EAX
                        STI
        }
}

望高人指点。。先谢谢啊。。

[培训]科锐逆向工程师培训第53期2025年7月8日开班！