In the x64 environment, Windows implemented more protection from patching SSDT. Initially, SSDT hooking was used by malware and anti-malware products alike. It was also used by sandboxes and other behavioral antivirus tools. However, in 64-bit version, Microsoft decided to stop this completely and began offering legitimate applications other alternatives rather than SSDT hooking.
Microsoft implemented multiple protections to stop SSDT hooking, such as PatchGuard (which we will talk about later in this chapter). Additionally, it stopped exporting KeServiceDescriptorTable via ntoskrnl.exe.
Since KeServiceDescriptorTable is not exported, malware families started to search for functions that used this table in order to gain access to the addresses. One of the functions they used was KiSystemServiceRepeat.
This function contains the following code:
lea r10, <KeServiceDescriptorTable>
lea r11, <KeServiceDescriptorTableShadow>
test DWORD PTR ...
