Реализация хука на Shadowssdt x64

NTSTATUS HookSHADOW(IN ULONG index, IN PVOID newAddr, OUT PVOID *ppOldAddr)
{
    ASSERT(newAddr != NULL);
    if (newAddr == NULL)
        return STATUS_INVALID_PARAMETER;
 
    NTSTATUS status = STATUS_SUCCESS;
    PKSERVICE_TABLE_DESCRIPTOR pSSDT = (ULONG_PTR)dynData.KiSystemCall64Shadow + sizeof(KSERVICE_TABLE_DESCRIPTOR);
    if (!pSSDT)
        return STATUS_NOT_FOUND;
 
    if (ppOldAddr)
        *ppOldAddr = (PUCHAR)pSSDT->ServiceTableBase + (((PLONG)pSSDT->ServiceTableBase)[index] >> 4);
 
    ULONG_PTR offset = (ULONG_PTR)newAddr - (ULONG_PTR)pSSDT->ServiceTableBase;
    if (offset > 0x07FFFFFF)
    {
        PVOID pTrampoline = BBFindTrampolineSpace(pSSDT->ServiceTableBase);
        if (!pTrampoline)
            return STATUS_NOT_FOUND;
 
        BBWriteTrampoline(pTrampoline, newAddr);
        offset = ((((ULONG_PTR)pTrampoline - (ULONG_PTR)pSSDT->ServiceTableBase) << 4) & 0xFFFFFFF0) | (pSSDT->ParamTableBase[index] >> 2);
    }
    else
        offset = ((offset << 4) & 0xFFFFFFF0) | (pSSDT->ParamTableBase[index] >> 2);
 
    ULONGLONG cr0 = __readcr0();
    __writecr0(cr0 & 0xFFFEFFFF);
    InterlockedExchange((PLONG)pSSDT->ServiceTableBase + index, (LONG)offset);
    __writecr0(cr0);
 
    return status;
}