Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What tool can I use to analyze Hooks (SSDT, Inline etc.) on Windows 7 / 2008? (x64 Platform)

Rku (Rootkit Unhooker) is the only tool I know, which is not available for x64 platforms.

share|improve this question
    
GMER seems fine and it works on 64 bit machines as well. –  Arun Aug 20 '13 at 12:00

1 Answer 1

up vote 2 down vote accepted

As Arun suggests, GMER scans for:

  • hidden processes
  • hidden threads
  • hidden modules
  • hidden services
  • hidden files
  • hidden disk sectors (MBR)
  • hidden Alternate Data Streams
  • hidden registry keys
  • drivers hooking SSDT
  • drivers hooking IDT
  • drivers hooking IRP calls
  • inline hooks

And it also run's fine on x64/x86 machines (currently testing it on my x64)

I haven't tested these but they might help:

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.