Tag: ssdt

• Tracing Windows Syscalls on 10/11: LSTAR, the SSDT, and Parameter-Count Determination

  2025-08-15

  Tracing Windows syscalls on Windows 10 and 11 via LSTAR and the SSDT, working out parameter counts to hook kernel calls cleanly, and the mechanism explained clearly.

• Reversing InfinityHook: Hooking Every System Call via the ETW CpuClock

  2020-03-26

  A line-by-line analysis of InfinityHook, the Windows technique that hooks every system call by abusing ETW's CpuClock provider, with the SSDT resolution flow fully explained.