Introduction - If you have any usage issues, please Google them yourself
Check that there is an EAT hook in the kernel. The kernel module's export function name and real address are obtained from the application layer through VB and then compared with the memory address. If different, recovery. -eat check whether there is linked to the kernel.vb obtained at the application layer through the kernel module exported function names and real addresses, and then compared with the memory address.