Simple Antirootkit Development Tutorial

Development Let’s develop a simple driver to detect and delete SST hooks. Therefore, our solution should not use Zw-functions and SST, as it is supposed that System Service Table is corrupted by malware. In this article, I am not going to pay attention to filter driver and function code splicers. However, I will probably do it in future.


Comparing current SST with the initial one located in ntoskernel.exe is the easiest way for hooks detecting and removing.

We should perform the following steps:

  1. Find ntoskernel module in memory.
  2. Find ntoskernel section, where SST is located, and calculate relative SST offset in section.
  3. Find ntoskernel section in ntoskernel.exe.
  4. Calculate real SST address in file.
  5. Read values from file and compare them with SST.

Before implementation, we’ll consider memory-mapped files in kernel mode.

Related:- Top 9 Google Sheets Tem­plates for Teachers

Memory-mapped files in kernel mode

Memory-mapped file is a virtual memory segment that has been assigned a direct byte-for-byte correlation with some portion of a file or file-like resource.

We are going to use memory-mapped files in kernel mode, as they are quite useful for parsing PE file. In addition, their API is really easy-to-use, as it is rather similar to Win32 API.

SST unhooker demonstration

We have considered steps for developing a simple console utility named “unhooker.exe” for testing purposes. We can start it with no parameters; in this case, it will show information about its abilities:

  1. 1. The “stat” command shows statistics about SST hooking.
  2. 2. The “unhook” command cleans up SST.

The following example demonstrates how to use utility to detect and delete hooks:

Related:-How to Get Apple Reminders on Windows

Anti-rootkit building

Steps for unhooker building are just as ones, described in the “Hide Driver” article:

    1. Install Windows Driver Developer Kit 2003
    2. Set global environment variable “BASEDIR” to path of installed DDK. Go here: Computer -> Properties -> Advanced -> Environment variables ->System Variables -> New

And set it like this: BASEDIR -> c:\winddk\3790
(You have to restart your computer after this.)

  1. If you choose Visual Studio 2003, then you can simply open UnhookerMain.sln and build it all.

Related Post

10 Emerging Technology Trends of 2020

Emerging Technology As 2019 is coming to an end, latest technology trends in information technology is introducing a progressive era bringing dynamic transformation in people’s lives. Despite the barriers, it’s

Top 10 new features in Node JS

If you have ever used the front-end development platform such as Angular which has also got its latest update of v8, then you might be knowing about Node JS. This

I’m living through the longest internet shutdown in history – here’s what life’s like for Kashmiris like me

Humaira Yusuf is among the thousands of Kashmiri medical students hoping to sit the National Eligibility Entrance Test, which selects students for undergraduate medical courses in India. Her plans, however,