Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What tool can I use to analyze Hooks (SSDT, Inline etc.) on Windows 7 / 2008? (x64 Platform)

Rku (Rootkit Unhooker) is the only tool I know, which is not available for x64 platforms.

share|improve this question

closed as off-topic by Xander, Scott Pack, TildalWave, Rory Alsop Sep 9 '14 at 17:33

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

GMER seems fine and it works on 64 bit machines as well. – Arun Aug 20 '13 at 12:00
up vote 2 down vote accepted

As Arun suggests, GMER scans for:

  • hidden processes
  • hidden threads
  • hidden modules
  • hidden services
  • hidden files
  • hidden disk sectors (MBR)
  • hidden Alternate Data Streams
  • hidden registry keys
  • drivers hooking SSDT
  • drivers hooking IDT
  • drivers hooking IRP calls
  • inline hooks

And it also run's fine on x64/x86 machines (currently testing it on my x64)

I haven't tested these but they might help:

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.