Skip to content

Instantly share code, notes, and snippets.

@ksose
ksose / ssdt.py
Created July 5, 2011 09:41
Detect SSDT hooks from user-mode in python
# k`sOSe - detect SSDT hooks
import ctypes
import struct
from ctypes.wintypes import *
from ctypes import windll
SYSCALLS = [
"NtAcceptConnectPort",
"NtAccessCheck",