Get the Whitepaper called From Win32 User-Land through Native API to Kernel. Includes demonstration code.
You can download it from the following link: https://packetstormsecurity.com/files/download/76169/3Steps.rar
Source: https://packetstormsecurity.com/files/76169/From-Win32-User-Land-Through-Native-API-To-Kernel.html