I thought Id publish something that I wrote in a private project over a year ago - how to hook the import address table of a driver (ring 0). Basically, lots of drivers will use kernel api that are exported by ntoskrnl.exe. If you wish to subvert a kernel mode driver (.sys), one easy way might be to hook a function it links against... but you might not want to hook it globally, as it will get picked up by rootkit detectors.
