Before revision: Hooking SSDT The SSDT maps syscalls to kernel function addresses.When a syscall is issued by a user space application, it contains the service index as parameter to indicate which syscall is called.
After revision: Function The SSDT maps syscalls to kernel function addresses.When a syscall is issued by a user space application, it contains the service index as parameter to indicate which syscall is called.