hooking NtSystemShutdown since it almost never gets called lol

5 years ago · 10a28f2706
parent b8d7b1a549
commit 10a28f2706
1 changed files with 1 additions and 1 deletions
--- a/physmeme/kernel_ctx/kernel_ctx.h
+++ b/physmeme/kernel_ctx/kernel_ctx.h
@ -84,7 +84,7 @@ namespace physmeme
 		//
 		// you can edit this how you choose, im hooking NtTraceControl.
 		//
-		const std::pair<std::string_view, std::string_view> syscall_hook = { "NtTraceControl", "ntdll.dll" };
+		const std::pair<std::string_view, std::string_view> syscall_hook = { "NtSystemShutdown", "ntdll.dll" };

 		//
 		// offset of function into a physical page