Nytro Posted March 14, 2016 Report Posted March 14, 2016 WinDBG Anti-RootKit Extension v1.5 released Posted on 15.02.2015 by SWW WDBGARK is an extension (dynamic library) for the Microsoft Debugging Tools for Windows. It main purpose is to view and analyze anomalies in Windows kernel using kernel debugger. It is possible to view various system callbacks, system tables, object types and so on. For more user-friendly view extension uses DML. For the most of the commands kernel-mode connection required. Feel free to use extension with live kernel-mode debugging or with kernel-mode crash dump analysis (some commands will not work). Public symbols required, so use them, force to reload them, ignore checksum problems, prepare them before analysis and you’ll be happy. Open source project hosted on GitHub, C++, nice Wiki – all of this made completely in my spare time just for fun. First public version is simple, but I have plans to continue development. WinDBG Anti-RootKit Extensionhttps://github.com/swwwolf/wdbgark 21 forks. 1 open issues. Recent commits: Code style fixing;Code Integrity information output tabbed; workaround for unresolvedexternal;, swwwolf optimization, swwwolf replace Microsoft's specific types with C++ types, swwwolf use WDbgArkSymbolsBase, swwwolf use WDbgArkSymbolsBase, swwwolf Sursa: http://sww-it.ru/2015-02-15/1242#.VuXglsjs4Ig.twitter Quote
