WinDBG Anti-RootKit (wdbgark) 2.5.0.0

WDBGARK is an extension (dynamic library) for the Microsoft Debugging Tools for Windows. It main purpose is to view and analyze anomalies in Windows kernel using kernel debugger. It is possible to view various system callbacks, system tables, object types and so on. For more user-friendly view extension uses DML. For the most of commands kernel-mode connection is required. Feel free to use extension with live kernel-mode debugging or with kernel-mode crash dump analysis (some commands will not work). Public symbols are required, so use them, force to reload them, ignore checksum problems, prepare them before analysis and you'll be happy.

Requirements

• Microsoft Visual Studio 2017
• WDK and SDK for Windows 10, version 1709 (10.0.16299.0)
• Visual C++ Redistributable for Visual Studio 2017

Supported commands

!wa_scan
!wa_systemcb
!wa_objtype
!wa_objtypeidx
!wa_objtypecb
!wa_callouts
!wa_pnptable
!wa_crashdmpcall
!wa_ssdt
!wa_w32psdt
!wa_checkmsr
!wa_idt
!wa_gdt
!wa_haltables
!wa_colorize
!wa_chknirvana
!wa_eop
!wa_cicallbacks
!wa_ciinfo
!wa_drvmajor
!wa_lxsdt
!wa_psppico
!wa_systables
!wa_apiset
!wa_process_anomaly
!wa_w32psdt
!wa_w32psdtflt
!wdrce_copyfile
!wdrce_cpuid

Supported Targets

• Microsoft Windows XP (x86)
• Microsoft Windows 2003 (x86/x64)
• Microsoft Windows Vista (x86/x64)
• Microsoft Windows 7 (x86/x64)
• Microsoft Windows 8.x (x86/x64)
• Microsoft Windows 10 (x86/x64)

Multiple targets debugging is not supported!

Windows BETA/RC is supported by design, but read a few notes. First, i don't care about checked builds. Second, i don't care if you don't have symbols (public or private). IA64/ARM is unsupported (and will not).