VC6下编译进Ring0代码的疑惑(4)

 RtlInitUnicodeString(&objName,L"DevicePhysicalMemory");
 InitializeObjectAttributes(&objectAttributes, &objName, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, (PSECURITY_DESCRIPTOR) NULL);
 status = ZwOpenSection(&hSection,SECTION_MAP_READ|SECTION_MAP_WRITE,&objectAttributes);
 
 //if(status == STATUS_ACCESS_DENIED) //这个地方就一直加强改写才行！
 {
  status = ZwOpenSection(&hSection,READ_CONTROL|WRITE_DAC,&objectAttributes);
  SetPhyscialMemorySectionCanBeWrited(hSection);
  ZwClose(hSection);
  status = ZwOpenSection(&hSection,SECTION_MAP_READ|SECTION_MAP_WRITE,&objectAttributes);
 }
 
 if(status != STATUS_SUCCESS)
 {
  printf("Error Open PhysicalMemory Section Object,Status:%08X ",status);
  return 0;
 }
 
 PVOID BaseAddress;
 BaseAddress=MapViewOfFile(hSection,
  FILE_MAP_READ|FILE_MAP_WRITE,
  0,
  mapAddr, //low part
  (gdt.Limit+1));
 if(!BaseAddress)
 {
  printf("Error MapViewOfFile:");
  PrintWin32Error(GetLastError());
  return 0;
 }
 
 BOOL setcg=FALSE;
 
 for(cg=(CALLGATE_DESCRIPTOR *)((ULONG)BaseAddress+(gdt.Limit&0xFFF8));(ULONG)cg>(ULONG)BaseAddress;cg--)
  if(cg->type == 0){
   cg->offset_0_15 = LOWORD(Entry);
   cg->selector = 8;
   cg->param_count = 0;
   cg->some_bits = 0;
   cg->type = 0xC; // 386 call gate
   cg->app_system = 0; // A system descriptor
   cg->dpl = 3; // Ring 3 code can call
   cg->present = 1;
   cg->offset_16_31 = HIWORD(Entry);
  
   setcg=TRUE;
   break;
  }
 
  if(!setcg){
   ZwClose(hSection);
   return 0;
  }
  char *msg=new char[1000];
  sprintf(msg,"BaseAddress=%x hSection=%x mapAddr=%x",BaseAddress,hSection,mapAddr);
  MessageBox(NULL,msg,NULL,NULL);
  delete [] msg;
  short farcall[3];
 
  farcall[2]=((short)((ULONG)cg-(ULONG)BaseAddress))|3; //Ring 3 callgate;
  if(!VirtualLock((PVOID)Entry,seglen))
  {
   printf("Error VirtualLock:");
   PrintWin32Error(GetLastError());
   return 0;
  }