What's wrong with my "SSDT HOOK ZwCreateSection"?

#include "ntddk.h"
#pragma pack(1)
typedef struct _SYS_SERVICE_TABLE { 
	void*ServiceTable;//
	void *CounterTable; //
	unsigned long ServiceLimit; //
	void*ArgumentsTable; 
}SYS_SERVICE_TABLE,*PSSDT; 
#pragma pack()
extern PSSDT KeServiceDescriptorTable; 
PMDL   g_pmdlSystemCall;//
void *MappedSSDT;//
const WCHAR devicename[]=L"\\Device\\Protector";//
const WCHAR devicelink[]=L"\\DosDevices\\PROTECTOR";//
typedef NTSTATUS (*CREATESECTION)(OUT PHANDLE  SectionHandle,IN ACCESS_MASK  DesiredAccess,IN POBJECT_ATTRIBUTES  ObjectAttributes OPTIONAL,IN PLARGE_INTEGER  MaximumSize OPTIONAL,IN ULONG  SectionPageProtection,IN ULONG  AllocationAttributes,IN HANDLE  FileHandle OPTIONAL);
CREATESECTION RealCallee;//
ULONG SSDT_Address;//
//------------------------------------------------------------------------------------------------------------------
//this function decides whether we should allow NtCreateSection() call to be successfull
NTSTATUS MyCreateSection(OUT PHANDLE  SectionHandle,IN ACCESS_MASK  DesiredAccess,IN POBJECT_ATTRIBUTES  ObjectAttributes OPTIONAL,IN PLARGE_INTEGER  MaximumSize OPTIONAL,IN ULONG  SectionPageProtection,IN ULONG  AllocationAttributes,IN HANDLE  FileHandle OPTIONAL) 
{
   
   return RealCallee(SectionHandle,DesiredAccess,ObjectAttributes,MaximumSize,SectionPageProtection,AllocationAttributes,FileHandle); 
}

//----------------------------Dispatch Routine--------------------------------------------------------------------
NTSTATUS DrvDispatch(IN PDEVICE_OBJECT device,IN PIRP Irp)
{
    ULONG Input; 
    PIO_STACK_LOCATION loc=IoGetCurrentIrpStackLocation(Irp);//
    if(Ioc->Parameters.DeviceIoControl.IoControlCode==1000)
	{
          SSDT_Address=(ULONG)(((PSSDT)MappedSSDT)->ServiceTable)+4*50;
          RealCallee=(CREATESECTION)(*((ULONG*)SSDT_Address));
	  Input=(ULONG)MyCreateSection;//
	  RtlMoveMemory((ULONG*)SSDT_Address,&Input,4);//         
	}
     Irp->IoStatus.Status=0;
          IoCompleteRequest(Irp,IO_NO_INCREMENT);
     return 0;
}
//-----------------------------------------------------------
// nothing special
NTSTATUS DrvCreateClose(IN PDEVICE_OBJECT device,IN PIRP Irp)
{
	
Irp->IoStatus.Information=0;
Irp->IoStatus.Status=0;
IoCompleteRequest(Irp,IO_NO_INCREMENT);
return 0;
}

//------------------------------------------------------------------------------------------------------------
// nothing special -just a cleanup
void DrvUnload(IN PDRIVER_OBJECT driver)
{
UNICODE_STRING devlink;
RtlMoveMemory((PVOID)SSDT_Address,&RealCallee,4);//
if(g_pmdlSystemCall)
{
MmUnmapLockedPages(MappedSSDT,g_pmdlSystemCall);//
MmUnlockPages(g_pmdlSystemCall);//
IoFreeMdl(g_pmdlSystemCall);
}
RtlInitUnicodeString(&devlink,devicelink);
IoDeleteSymbolicLink(&devlink);
IoDeleteDevice(driver->DeviceObject);
KdPrint(("Unloaded.\n"));
}
//--------------------------------------------------------------------------------------------------------
//DriverEntry just creates our device - nothing special here initial SSDT
NTSTATUS DriverEntry(IN PDRIVER_OBJECT driver,IN PUNICODE_STRING path)
{
PDEVICE_OBJECT devobject;
UNICODE_STRING devlink,devname;//
devobject=0;
RtlInitUnicodeString(&devname,devicename);//
RtlInitUnicodeString(&devlink,devicelink);
IoCreateDevice(driver,256,&devname,FILE_DEVICE_UNKNOWN,0,TRUE,&devobject);//
IoCreateSymbolicLink(&devlink,&devname);//

driver->MajorFunction[IRP_MJ_DEVICE_CONTROL]=DrvDispatch;//
driver->MajorFunction[IRP_MJ_CREATE]=DrvCreateClose;//
driver->MajorFunction[IRP_MJ_CLOSE]=DrvCreateClose;//
driver->DriverUnload=DrvUnload;//
g_pmdlSystemCall =IoAllocateMdl(KeServiceDescriptorTable->ServiceTable,KeServiceDescriptorTable->ServiceLimit*4,FALSE,FALSE,NULL);//allocate
if(!g_pmdlSystemCall)
  return STATUS_UNSUCCESSFUL;
  
MmBuildMdlForNonPagedPool(g_pmdlSystemCall);//
MmProbeAndLockPages(g_pmdlSystemCall,KernelMode,IoWriteAccess);//lock it  and modify its protection attributes
MappedSSDT=MmMapLockedPagesSpecifyCache(            
										g_pmdlSystemCall,
										KernelMode,
										MmCached,
										NULL,
										FALSE,
										NormalPagePriority
										);			//get the virtual start address								
return 0;
}