查找进程，目录/文件，注册表等操作系统将最终调用

ZwQueryDirectoryFile，ZwQuerySystemInformation，ZwXXXvalueKey

等函数。要想拦截这些函数达到隐藏目的，需先自己实现以上函数，

并修改系统维护的一个 SYSCALL 表使之指向自己预先定义的函数。

因 SYSCALL 表在用户层不可见，所以要写 DRIVE 在 RING 0 下 才

可修改。-the search process, directories / files, the registry, such as the operating system will eventually call ZwQueryDirectoryFile, ZwQuerySystemInformation, ZwXXXvalueKey functions. To achieve these functions interception hidden purpose, the need to achieve over his first function, and modifying the system to maintain a SYSCALL table to make it at their pre-defined function. SYSCALL table for the user-visible, write DRIVE at RING 0 under any amendment.