Cover V12, I09
sep2003.tar

Figure 2 How a kernel rootkit subverts the normal system calls