Skip to content

Instantly share code, notes, and snippets.

@olivierlemoal

olivierlemoal/Windbg

Last active August 29, 2015 14:26
Show Gist options
  • Save olivierlemoal/5bffc2242fc058ef8b2d to your computer and use it in GitHub Desktop.
Save olivierlemoal/5bffc2242fc058ef8b2d to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Windbg
List driver objects :
kd> !object \Driver
Display driver structure :
kd> dt nt!_DRIVER_OBJECT 0x000000
Display SSDT:
kd> dd dwo(KeServiceDescriptorTable) L100
Driver :
See http://www.malwaretech.com/2015/02/bootkit-disk-forensics-part-1.html
Major function table:
kd> dds 0x000000 + 0x38 L1C
Or
kd> !drvobj 0x000000 2
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment