Class 09 · KP 09 / 25

SSDT Redirect (Diagram)

SSDT hook: redirect a syscall (e.g. NtQueryDirectoryFile) to hide artifacts.

The rootkit calls the real routine, strips rows that name its files or

process, and returns the trimmed result upward.