Analyst’s Perspective: Analyzing User Mode State from a Kernel Connection