检查内核中是否存在EAT挂钩。在应用层通过VB获得内核模块的导出函数名及真实地址，然后与内存地址相比较。若不同，则恢复。-EAT check whether there is linked to the kernel. VB obtained at the application layer through the kernel module exported function names and real addresses, and then compared with the memory