[rwth-security] Detecting Hotkey- Based Keyloggers Using an Undocumented Kernel Data Structure