v2.1 bugfix

Same features as v2.1. Fixed:

• Restoring callbacks on unload was wrong
• Long standing BSODs on 32bits related to ntoskrnl loaded from userspace being mis-detected or mis-relocated. Fixed by scanning in kernel instead.