Next Class

• Lab 3 Part B — breakpoint MessageBoxW, read RCX/RDX/R8/R9, and demonstrate a hook.
• Class 09 — Rootkits: kernel-mode hooking (SSDT, ftrace/kprobes) and hiding techniques in depth.
• Review the x64 calling convention before lab.