Where does https://github.com/ozkl/soso first switch to Ring 3? I want to rip it out and just run everything in Ring 0.