changed ntoskrnl function that we hook to `NtShutdownSystem`

5 years ago · 6e35a0cc7e
parent 10a28f2706
commit 6e35a0cc7e
1 changed files with 1 additions and 1 deletions
--- a/physmeme/kernel_ctx/kernel_ctx.h
+++ b/physmeme/kernel_ctx/kernel_ctx.h
@ -84,7 +84,7 @@ namespace physmeme
 		//
 		// you can edit this how you choose, im hooking NtTraceControl.
 		//
-		const std::pair<std::string_view, std::string_view> syscall_hook = { "NtSystemShutdown", "ntdll.dll" };
+		const std::pair<std::string_view, std::string_view> syscall_hook = { "NtShutdownSystem", "ntdll.dll" };

 		//
 		// offset of function into a physical page