Tracing Windows Syscalls on 10/11: LSTAR, the SSDT, and Parameter-Count Determination
Tracing Windows syscalls on Windows 10 and 11 via LSTAR and the SSDT, working out parameter counts to hook kernel calls cleanly, and the mechanism explained clearly.