+ hook ZwUserCallOneParam (shadow ssdt)