Software and web application security

February 6, 2007

Checking ntoskrnl for rootkit

Filed under: general — chrisweber @ 12:27 pm

This is not new, but I needed it the other day and wanted to post it here for memory. In Microsoft’s kernel debugger tool ‘kd‘ the following command checks for binary corruption in every loaded module.  Note also that you can do this with Sysinternal’s ‘LiveKd‘ for easier on the fly debugging.

kd> !for_each_module !chkimg @#ModuleName

Make sure you have trusted modules to compare against first. And point to them before running the above command with:

kd> .exepath c:\Windows\system32


Leave a Comment »

No comments yet.

RSS feed for comments on this post. TrackBack URI

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

Create a free website or blog at

%d bloggers like this: