It uses multiple techniques such as direct syscall implementation, CSRSS process handle detection, PIDB method etc to find out the user land rootkit processes.

• 它使用多种技术，如直接syscall执行，CSRSS进程句柄检测方法等PIDB找出使用者土地的rootkit进程。