Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What tool can I use to analyze Hooks (SSDT, Inline etc.) on Windows 7 / 2008? (x64 Platform)

Rku (Rootkit Unhooker) is the only tool I know, which is not available for x64 platforms.

share|improve this question

closed as off-topic by Xander, Scott Pack, TildalWave, Rory Alsop Sep 9 at 17:33

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

    
GMER seems fine and it works on 64 bit machines as well. –  Arun Aug 20 '13 at 12:00

1 Answer 1

up vote 2 down vote accepted

As Arun suggests, GMER scans for:

  • hidden processes
  • hidden threads
  • hidden modules
  • hidden services
  • hidden files
  • hidden disk sectors (MBR)
  • hidden Alternate Data Streams
  • hidden registry keys
  • drivers hooking SSDT
  • drivers hooking IDT
  • drivers hooking IRP calls
  • inline hooks

And it also run's fine on x64/x86 machines (currently testing it on my x64)

I haven't tested these but they might help:

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.