Paper: Hunting rootkits with Windbg

[frank_boldewin]

Here are the slides to my talk "Hunting rootkits with Windbg" at the Ruhr University of Bochum yesterday. I'll introduce several ways to find well known rootkits like Rustock or TDL Versions 3+4 with Windbg and scripts. Enjoy!

Paper

The Windbg script shown in the slides to grab Kernelcallbacks can be found here:

Windbg Script

Edited January 22, 2011 by frank_boldewin

[kristjan84]

I really enjoyed reading your slides, and learnt alot from them.

Thanks

[Pooya]

Hi

May I know if there is any video source of your talk ?