SST Hook -> Bluescreen!?

[Cobi]

Hi there,
For educational purpose (?) i want to code a File/Regmon Clone, with the same method of SystemServiceTable Hooking described in "Undocumented Windows NT" but when i try to Patch i get a Bluescreen "DRIVER_IRQL_NOT_LESS_OR_EQUAL" !?

extern	PSERVICE_DESCRIPTOR_TABLE	KeServiceDescriptorTable;
#define	SYSTEMSERVICE(_function)	KeServiceDescriptorTable->ntoskrnl.ServiceTable[*(PULONG)((PUCHAR)_function+1)]

_asm cli;
(NTCREATEFILE)(SYSTEMSERVICE(ZwCreateFile)) = NewZwCreateFile; // <---#HERE#
_asm sti;

The System crashes directly when i try to Patch.
Is the Table in WinXP write protected or whats going on?
The whole source is attached.
Happy new Year @all
-Cobi