replace and unhook ntdll from a suspended process - View it on GitHub