Bypass the Event Trace Windows(ETW) and unhook ntdll. - View it on GitHub