ssdt钩子检测，利用查找ntkrnlpa.exe中导出的ssdt的起始地址和大小，比较实际的ssdt地址表中的内容，找出钩子-ssdt hook detection, the use of export ntkrnlpa.exe Find ssdt the start address and size, a more realistic ssdt address the contents of the table to find ou

创建一个内核驱动，伪造一个ssdt表，使得ssdt钩子失效。-Create a kernel driver, forged a ssdt table, making failure ssdt hook.