WDBGARK
A WinDBG extension for viewing and analyzing Windows kernel anomalies to detect rootkits and system modifications.
What is WDBGARK?
WDBGARK is a WinDBG extension built to detect rootkits and analyze anomalies within the Windows kernel. It provides a suite of commands to inspect system callbacks, object types, service descriptor tables, and other critical kernel structures, helping identify unauthorized modifications. The tool is used during live kernel debugging or crash dump analysis to uncover hidden malware and system compromises.
Security researchers, malware analysts, and forensic investigators who need to examine Windows kernel internals for signs of rootkits or system tampering using WinDBG.
Developers choose WDBGARK for its specialized focus on kernel-level anti-rootkit analysis within WinDBG, offering a comprehensive, command-driven alternative to manual inspection or scripting-based approaches, with built-in support for multiple Windows versions and architectures.
Overview
WinDBG Anti-RootKit Extension
Use Cases
Best For
- Detecting kernel-level rootkits in Windows systems
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
