Utilizing major function swaps to hook the ioctl request used to query the ARP table.
Remarks:
- Designed to be loaded via a manual mapper like TheCruZ's "KDMAPPER"
- Simply makes the function return ACCESS_DENIED, but ideally you should parse the ioctl buffer and instead change every mac entry (assuming this will be used for spoofing)
Demonstration:

