The hook, from ring3 there are many, ring3 to ring0 there are many, according to api call progressive sequence of links, each link in the opportunity to have a hook, you can have int 2e or sysenter hook, ssdt hook, inline hook, irp hook, object hook, idt hook, etc.

Filename	Size	Update
2）ssdt hook
............\2）ssdt hook.doc
............\SSDT Hook的妙用－对抗ring0 inline hook .doc
............\swk0207.rar
3）inline-hook
..............\360SuperKill学习之--恢复FSD的IRP处理函数.doc
..............\3）inline-hook.doc
..............\cnnic.rar
..............\ExpLookupHandleTableEntry.rar
..............\ExpLookupHandleTableEntry2.rar
..............\kill_SecuritySoftware.rar
..............\PsLookupProcessByProcessId执行流程学习笔记.doc
..............\句柄啊，3层表啊，ExpLookupHandleTableEntry啊.doc
..............\干掉KV 2008	Rising等大部分杀软.doc
..............\搜索未导出的函数地址.doc
4）idt hook
...........\bhwin_keysniff.rar
...........\IDT Hook .doc

• We are an exchange download platform that only provides communication channels. The downloaded content comes from the internet. Except for download issues, please Google on your own.
• The downloaded content is provided for members to upload. If it unintentionally infringes on your copyright, please contact us.
• Please use Winrar for decompression tools
• If download fail, Try it againg or Feedback to us.
• If downloaded content did not match the introduction, Feedback to us，Confirm and will be refund.
• Before downloading, you can inquire through the uploaded person information

Nothing．