README.md

Pointer swaps HalPrivateDispatchTable to intercept syscall dispatches through CKCL trace.

Features

• Works on Windows 10/11 (22H2–25H2)
• No PatchGuard issues

NtOpenFile Hook Demo

License

MIT

Credits: https://github.com/mapozyan/etw_hook