确实是这样！相对来说绕过NP对NtUserSendInput的HOOK比绕其他ntoskrnl.exe上面的函数稍微复杂一点点！但是这样做的实际意义并不是很大，因为进入ring0可以做的事情就很多，比如直接用in out 模拟按键就比打开NP的HOOK的NtUserSendInput再在ring3 keybd_event模拟要简单得多。其他内核函数也是一样！
microsoft 對 hupigon 的定義:
Win32/Hupigon is a family of backdoor Trojans. A Win32/Hupigon infection includes TrojanDropper:Win32/Hupigon and two to three files that the dropper installs. These additional files include Backdoor:Win32/Hupigon, the main backdoor component, and Backdoor:Win32/Hupigon!hook, a stealth component that hides files and processes associated with Win32/Hupigon. The Trojan dropper may also install PWS:Win32/Hupigon, a plugin that logs keystrokes and steals passwords. Win32/Hupigon may support other malicious plugins as well.
