From 825c08b2fbfbc2554f656d9d97ce809c96844cc1 Mon Sep 17 00:00:00 2001
From: Winslow <33692631+senzee1984@users.noreply.github.com>
Date: Wed, 28 Feb 2024 14:19:40 -0500
Subject: [PATCH] Update README.md

---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index 58d3e03..f2a3c01 100644
--- a/README.md
+++ b/README.md
@@ -5,6 +5,7 @@ It works by calling an unhooked NTAPI and replacing the unhooked NTAPI's SSN wit
 
 The provided project is only a `POC`, not a comprehensive implementation. For instance, you could use this approach to set hardware breakpoints for a set of functions. 
 
+The technical article can be read at <https://winslow1984.com/books/malware/page/mutationgate>.
 
 ## Description
 EDR tends to set inline hooks for various NTAPI, especially those are usually leveraged in malware, such as `NtAllocVirtualMemory`, `NtOpenProcess`, etc. While other NTAPI that are not usually leveraged in malware tend not to have inline hook, such as `NtDrawText`. It is very unlikely that an EDR set inline hook for all NTAPI.