InfinityHook on Modern Windows: An ETW-Based Hook That Survives PatchGuard
InfinityHook on modern Windows: an ETW-based syscall hook that survives PatchGuard, with the reverse-engineered pieces the original writeup left out, with the setup and commands all covered.