https://dwt.life/archives/30/ graph TDA(内核加载) --> J["获取HOOK表、关闭写保护"];J --> B[hook sys method];B --> C[Write]...