Kernel Rootkit & Ring 0 Driver DissectorRing 0 Kernel Mode
Windows Kernel Driver (.sys) reverse engineering suite: SSDT syscall table scanning, IRP MajorFunction hook detection, DKOM unlinked ghost process recovery, and BYOVD vulnerability intelligence.
Kernel Snapshot:tdss.sys + gdrv.sys (Live Ring 0)
OS:Win 11 23H2 (x64)
Loaded Drivers
194Ring 0
ntoskrnl.exe image base
Hooked SSDT Syscalls
4KiServiceTable
Syscall redirection active
Hijacked IRP Dispatchers
1MajorFunction
Disk & TCP stack intercepted
DKOM Ghost Processes
2Unlinked
ActiveProcessLinks spliced
BYOVD Drivers Detected
4CVE Matched
OEM vulnerable signed .sys
Kernel Integrity
38%CRITICAL
Rootkit infection active
System Service Descriptor Table (SSDT / KiServiceTable) Hook Inspector
Scans kernel syscall dispatch table entries (`ntoskrnl.exe!KiServiceTable`). Detects pointer redirections, inline trampoline JMPs, and byte patches installed by Ring 0 rootkits.
SSDT Dispatch Entries4 Hooked Routines Diverted to Rootkit
| Index | Syscall Routine | Expected Address | Live Target Address | Hook Type | Status | Malicious Stealth Intent | Action |
|---|---|---|---|---|---|---|---|
| 0x0033 | NtQueryDirectoryFile | 0xFFFFF800'04218000 (ntoskrnl.exe) | 0xFFFFF800'06F21040 (tdss.sys + 0x1040) | Pointer Redirection | HOOKED | Filters file enumeration requests; hides files matching prefix 'tdss_*' and rootkit loader binaries from Windows Explorer and cmd.exe dir. | |
| 0x0036 | NtQuerySystemInformation | 0xFFFFF800'04221000 (ntoskrnl.exe) | 0xFFFFF800'06F21480 (tdss.sys + 0x1480) | Inline Trampoline (JMP) | HOOKED | Splices SystemProcessInformation query results to erase rootkit PIDs (e.g. PID 4920, 6608) from Task Manager and Process Hacker. | |
| 0x0026 | NtOpenProcess | 0xFFFFF800'04215000 (ntoskrnl.exe) | 0xFFFFF800'06F21890 (tdss.sys + 0x1890) | Pointer Redirection | HOOKED | Returns STATUS_ACCESS_DENIED whenever security products (MsSense.exe, SentinelAgent.exe) attempt to open handles to rootkit processes. | |
| 0x002C | NtTerminateProcess | 0xFFFFF800'04219A00 (ntoskrnl.exe) | 0xFFFFF800'06F21CA0 (tdss.sys + 0x1CA0) | Byte Patch | HOOKED | Blocks termination signals targeted at malicious worker services, rendering the malware process unkillable via standard Userland calls. | |
| 0x0018 | NtAllocateVirtualMemory | 0xFFFFF800'04210000 (ntoskrnl.exe) | 0xFFFFF800'04210000 (ntoskrnl.exe) | Clean (ntoskrnl) | CLEAN | Standard dispatch routine (unmodified). | Restored |
| 0x0050 | NtProtectVirtualMemory | 0xFFFFF800'04212400 (ntoskrnl.exe) | 0xFFFFF800'04212400 (ntoskrnl.exe) | Clean (ntoskrnl) | CLEAN | Standard dispatch routine (unmodified). | Restored |