
add filtering by call groups, like strace on linux.

modify argument info to have a user-space type and a kernel-space
type.  (many user-space types map to one kernel-space type, saves code
duplication)

add more argument info

fix the ntcrash crashes

find a way to remove the large buffer from the stack.  It's not a good
idea in general to eat so much kernel stack space.

check if previous mode was kernel, and if so, allow arguments to be
in kernel space.

find some way of letting the driver unload without rebooting (or BSOD)
