Different ways to install kernel hooks under Windows NT based systems

1. Via installing a standard device driver
Calling the CreateService API with the service type parameter set to SERVICE_KERNEL_DRIVER makes the driver to be installed into the kernel. The Service Control Manager (SCM) then will tack care of starting and unloading the driver. This is the only documented way.

2. Using SystemLoadAndCallImage
The Native API NtSetSystemInformation is generally used to set information that affects the operation of the system. While the information class SystemLoadAndCallImage would load a module into the kernel address space and call its entry point. It is very simple but it's impossible to automatically start the driver on system boot. It seems that smss.exe use this method to load win32 subsystem during startup.
REF: Windows NT/2000 Native API Reference

3. Through the Windows object /Device/PhysicalMemory
This method has been explained in details by crazylord, but it is quite complicated and challenging and I have not mastered yet.
REF: Playing with Windows /dev/(k)mem, Phrack Inc, Volume 0x0b, Issue 0x3b