The program draws with win32k gdi functions in the kernel while NtGdiDdDDISubmitCommand is being hooked. - View it on GitHub