I was thinking of creating a tool for malware analysis using SSDT hooking, but i had some doubts when creating this.
I want to know what module (process) is invoking a syscall when it hits my kernel mode callback handler, something like:
"The process xxx.exe called NtQuerySystemInformation"
I think i can do it by some "stack walking" routine, but idk how.
PS: It's not in the Ring3 (usermode) context, I dont want to make ring3 hooks.
Sorry, i won't have the source code example for now, i'm not on my computer.