我文中的描述确实不对。谢谢，大侠指点。
小弟汇编能力有限对于
4b898c1a80882a00 mov qword ptr [r10+r11+2A8880h],rcx
不会解析所以觉得在这个函数里搜索不太方便。我文中的描述确实不对。谢谢，大侠指点。
nt!KeAddSystemServiceTable:
fffff800`03fe5cd0 8b442428 mov eax,dword ptr [rsp+28h]
fffff800`03fe5cd4 83f801 cmp eax,1
fffff800`03fe5cd7 776c ja nt!KeAddSystemServiceTable+0x75 (fffff800`03fe5d45)
fffff800`03fe5cd9 4c8bd0 mov r10,rax
fffff800`03fe5cdc 4c8d1d1dd3c1ff lea r11,[nt!MmIsSessionAddress <PERF> (nt+0x0) (fffff800`03c03000)]
fffff800`03fe5ce3 49c1e205 shl r10,5
fffff800`03fe5ce7 4b83bc1a40882a0000 cmp qword ptr [r10+r11+2A8840h],0
fffff800`03fe5cf0 7553 jne nt!KeAddSystemServiceTable+0x75 (fffff800`03fe5d45)
fffff800`03fe5cf2 4b83bc1a80882a0000 cmp qword ptr [r10+r11+2A8880h],0
fffff800`03fe5cfb 7548 jne nt!KeAddSystemServiceTable+0x75 (fffff800`03fe5d45)
fffff800`03fe5cfd 4b898c1a80882a00 mov qword ptr [r10+r11+2A8880h],rcx
fffff800`03fe5d05 4b89941a88882a00 mov qword ptr [r10+r11+2A8888h],rdx
fffff800`03fe5d0d 4789841a90882a00 mov dword ptr [r10+r11+2A8890h],r8d
fffff800`03fe5d15 4f898c1a98882a00 mov qword ptr [r10+r11+2A8898h],r9
fffff800`03fe5d1d 83f801 cmp eax,1
fffff800`03fe5d20 7420 je nt!KeAddSystemServiceTable+0x72 (fffff800`03fe5d42)
fffff800`03fe5d22 4b898c1a40882a00 mov qword ptr [r10+r11+2A8840h],rcx
fffff800`03fe5d2a 4b89941a48882a00 mov qword ptr [r10+r11+2A8848h],rdx
fffff800`03fe5d32 4789841a50882a00 mov dword ptr [r10+r11+2A8850h],r8d
fffff800`03fe5d3a 4f898c1a58882a00 mov qword ptr [r10+r11+2A8858h],r9
fffff800`03fe5d42 b001 mov al,1
fffff800`03fe5d44 c3 ret
fffff800`03fe5d45 32c0 xor al,al
fffff800`03fe5d47 c3 ret
fffff800`03fe5d48 90 nop
fffff800`03fe5d49 90 nop
fffff800`03fe5d4a 90 nop
fffff800`03fe5d4b 90 nop
fffff800`03fe5d4c 90 nop
fffff800`03fe5d4d 90 nop
fffff800`03fe5d4e 90 nop
fffff800`03fe5d4f 90 nop