Kernel Detective v1.2 January 24, 2009Posted by reversengineering in DETECTOR, OTHER, TOOLS.
Kernel Detective is a free tool that help you detect, analyze, manually modify and fix some Windows NT kernel modifications. Kernel Detective gives you the access to the kernel directly so it’s not oriented for newbies. Changing essential kernel-mode objects without enough knowledge will lead you to only one result … BSoD !
Kernel Detective gives you the ability to :
1- Detect Hidden Processes.
3- Detect Hidden Threads.
2- Detect Hidden DLLs.
3- Detect Hidden Handles.
4- Detect Hidden Driver.
5- Detect Hooked SSDT.
6- Detect Hooked Shadow SSDT.
7- Detect Hooked IDT.
8- Detect Kernel-mode code modifications and hooks.
9- Disassemble (Read/Write) Kernel-mode/User-mode memory.
10- Monitor debug output on your system.
Now Support Vista Service Pack 1 (Build 6001) .
[+] Added Hidden/Suspicious Threads Detection .
[+] Added Smart Process Termination Technique .
[*] Improved Handles Detection .
[*] Improved Processes Detection .
[*] Improved Drivers Detection .
[*] Improved User-mode Memory Reader On Vista .
[!] Fixed bug in IAT Hooks Detection