Okay, so I am developing a kernel module that does kernel mode hooking to hook APIs and modify some values. But is there anyway I could tell if what program called a specific API? Say a program from user-land calls NtQuerySystemInformation() (which in turn, will be ZwQuerySystemInformation() but on kernel-land) and I have hooked that (the Zw-func one) specific function from the kernel space. Is there any way of telling if what user-land program did the call to that Nt-function which called the Zw-function (which I hooked)?
I want to be able to log what APIs does a program calls (like an AV).