VC6下编译进Ring0代码的疑惑(2)

#define STATUS_SUCCESS ((NTSTATUS)0x00000000L) // ntsubauth
#define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L)
//#pragma comment(lib,"C:NTDDKlibfrei386 tdll.lib")

#define ENTERRING0 _asm pushad
 _asm pushf
_asm cli

#define LEAVERING0 _asm popf
 _asm popad
_asm retf

typedef struct gdtr {
 unsigned short Limit;
 unsigned short BaseLow;
 unsigned short BaseHigh;
} Gdtr_t, *PGdtr_t;

typedef struct {
 unsigned short offset_0_15;
 unsigned short selector;
 
 unsigned char param_count : 4;
 unsigned char some_bits : 4;
 
 unsigned char type : 4;
 unsigned char app_system : 1;
 unsigned char dpl : 2;
 unsigned char present : 1;
 
 unsigned short offset_16_31;
} CALLGATE_DESCRIPTOR;

void PrintWin32Error( DWORD ErrorCode )
{
 LPVOID lpMsgBuf;
 
 FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM, NULL, ErrorCode, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), (LPTSTR) &lpMsgBuf, 0, NULL);
 printf("%s ", lpMsgBuf );
 LocalFree( lpMsgBuf );
}

ULONG MiniMmGetPhysicalAddress(ULONG virtualaddress)
{
 if(virtualaddress<0x80000000||virtualaddress>=0xA0000000)
  return 0;
 return virtualaddress&0x1FFFF000;
}

VOID SetPhyscialMemorySectionCanBeWrited(HANDLE hSection)
{
 PACL pDacl=NULL;
 PACL pNewDacl=NULL;
 PSECURITY_DESCRIPTOR pSD=NULL;
 DWORD dwRes;
 EXPLICIT_ACCESS ea;