STDRestore

10/08/06 Posted by geswall

Link: http://www.security.org.sg/code/sdtrestore.html

STDRestore is a tool that demonstrates the possibility of defeating rootkits by removing Kernel Native APIs hooks and restoring the ServiceTable entries back to their original state. The similar technique can be used by rootkits as well.

Isolated STDResource have not enough privileges to access physical memory device in order to modify Service Table.

Link: http://www.security.org.sg/code/sdtrestore.html