SSDT Hook/Rootkit Detector.

So I was bored the other day and wanted to code something that would get me back into coding as I’ve had a bit of a break.

This is the result:

I wrote a quick unhook function but its erratic at best and keeps BSOD’ing me… So I’ll update this once I’ve got that working flawlessly.

If it DOES pick something up, make a note of what it is because it may be perfectly legit. For instance various AV’s hook NtOpenProcess to protect its main process. However, if it pics something like NtQueryDirectoryFile chances are you’ve got a rootkit. However, if it doenst pick anything up… thats a good thing.

In the pic I hooked several items, for demonstration purposes.

Driver: 90% inline assembly, 10% C.
GUI: 100% C++.

SSDTRootkitDetector