Modify the Circular Kernel Context Logger by changing the events it logs enableFlags should be one or multiple OR'd EVENT_TRACE_FLAG constants

Get the internal kernel WMI_LOGGER_CONTEXT for the Circular Kernel Context Logger from etwpDebuggerData

Modify the internal kernel counter structure so it executes our hook

Places a hook on any system call function

Get the searched section from a module

Query all system kernel modules and return the start address and size of the searched module

Pattern scan for KeServiceDescriptorTableShadow in KiSystemCall64

This hook function is called for each event configured to be logged by ETW

Scan for a memory pattern