Detect WOW64 stub modification

Author: Coder666

HookDump.cpp

@@ -596,7 +596,7 @@ namespace zp
                         //check for inter-segment branch
                         if (instruction.meta.branch_type != ZYDIS_BRANCH_TYPE_FAR)
                         {
-                            printf("\n[-] WOW64 system call stub [WOW]\n");
+                            printf("[-] WOW64 system call stub [WOW]\n");
                             DumpInstruction(instruction, (UINT_PTR)pTeb->WOW32Reserved);
                             return TRUE;
                         }

README.md

@@ -23,6 +23,10 @@ Please refer to the Zeroperil blog post for more information [https://zeroperil.
 
 A jump instruction has been patched into the function to redirect execution flow
 
+### WOW
+
+Detection of the WOW64 syscall stub being hooked, which allows filtering of all system calls
+
 ### EAT 
 
 The address in the export address table does not match the address in the export address table in the copy on disc
@@ -34,3 +38,4 @@ GetProcAddress hook, an experimental feature, this is only output in verbose mod
 ## Verification
 
 The only way to truly verify the correct working of the program is to check in a debugger if hooks are present.  If you are getting a zero hooks result and are expecting to see something different, then first verify this in a debugger and please get in touch.
+