Im trying to understand the execution flow from
user32.UnregisterUserApiHook to the belonged System call :
NtUserUnregisterUserApiHook if i am right.
Currently i cant use Windbg (kernel debugger) to step through every call to see where i get. So i try to use IDA .
I have tryed the following things (with IDA):
Locate KiFastCallEntry in ntoskrnl.exe : not found Locate NtUserUnregisterUserApiHook in win32k.sys : not found
Question: how to get these functions listed here displayed in to IDA ?
Target OS is Windows 7 32 bit