Kernel Detective [upd] Jun 2026

: Enumerates loaded drivers and identifies unsigned or suspicious kernel modules.

There are several types of kernels, including: kernel detective

. Many rootkits "hook" this table to intercept system calls (e.g., hiding a file by intercepting "read directory" calls). Kernel Detective can identify these redirections and compare current addresses against original kernel values. Kernel Module Enumeration: Listing all loaded drivers ( .sys files) and their memory addresses, which is crucial for identifying unauthorized or malicious kernel-mode drivers. Shadow SSDT Hooking: Similar to the standard SSDT, this table manages graphical and windowing system calls (Win32k.sys), another common target for advanced malware. Use Cases in Security Research Anti-Rootkit Operations: Before modern Windows features like Kernel Patch Protection (PatchGuard) became standard, Kernel Detective was a go-to tool for manually finding and removing persistent threats that evaded standard antivirus software. Reverse Engineering: Developers used it to understand how undocumented Windows APIs function and how various system components interact in real-time. Digital Forensics: Investigators employed it to capture the state of kernel memory during live system analysis to identify signs of compromise. Modern Status and Legacy While Kernel Detective was a powerhouse in the mid-2000s, it has largely been superseded by newer tools and OS-level security. Compatibility: It primarily targeted 32-bit (x86) versions of Windows. The introduction of 64-bit Windows brought : Enumerates loaded drivers and identifies unsigned or

: Systems programmers and embedded software engineers may use similar kernel-level tools to troubleshoot driver conflicts or memory leaks that occur outside of user-mode space. Legacy and Modern Alternatives Kernel Detective can identify these redirections and compare

Historically, Kernel Detective has been utilized in several niche technical areas:

: Documentation and legacy downloads are available at Bitlackeys Research.