SSDT Hook/Rootkit Detector.
So I was bored the other day and wanted to code something that would get me back into coding as I’ve had a bit of a break.
This is the result:
I wrote a quick unhook function but its erratic at best and keeps BSOD’ing me… So I’ll update this once I’ve got that working flawlessly.
If it DOES pick something up, make a note of what it is because it may be perfectly legit. For instance various AV’s hook NtOpenProcess to protect its main process. However, if it pics something like NtQueryDirectoryFile chances are you’ve got a rootkit. However, if it doenst pick anything up… thats a good thing.
In the pic I hooked several items, for demonstration purposes.
Driver: 90% inline assembly, 10% C.
GUI: 100% C++.
If you want, you can download it here.
Note: I’m 99.99% sure it wont work on Vista – so its confined to all versions of Windows XP.
[...] around and wrote a peice of code to detect hidden processes… so I decided to add it to another program I wrote a few months ago, and create a full-fledged [...]
Rootkit Detector v2? « said this on December 25, 2007 at 12:27 am
Where i could download the source for hidden processes part?
Thanks!
Frement said this on June 12, 2009 at 12:14 am
This program contains a rootkit c:\ssdtenum\libchk_wxp_x86\i386\detect.pdb
Fuckyou said this on November 13, 2009 at 11:03 am
Fuckyou (oh how original!): Yes in a sense it does contain a rootkit, however it is benign and is there to do a job. It installs a kernel mode driver (the so called “rootkit”) to detect MALICIOUS ROOTKITS. A rootkit is simply a peice of code which runs as “root”. Now, perhaps next time you should check your facts before you show yourself to be an ignorant idiot.
Rhys M. said this on November 13, 2009 at 12:09 pm
Anyway, I’m not sure why youre downloading this one.
Try the http://somebastardstolemyname.wordpress.com/2007/12/25/rootkit-detector-v2/
Rhys M. said this on November 13, 2009 at 12:11 pm