# Kernel-Level Analysis Guide

## Windows Kernel Analysis

### SSDT Analysis
The System Service Descriptor Table maps system call numbers to kernel function addresses.

```
# Volatility 3 SSDT analysis
volatility3 -f memory.dmp windows.ssdt

# Normal: all entries point to ntoskrnl.exe or win32k.sys
# Hooked: entries pointing to unknown driver addresses
```

**Key SSDT entries to verify:**
| Index | Function | Rootkit Use |
|-------|----------|-------------|
| 0x0025 | NtCreateFile | File access interception |
| 0x0035 | NtQueryDirectoryFile | File/directory hiding |
| 0x00AD | NtQuerySystemInformation | Process hiding |
| 0x00BA | NtEnumerateValueKey | Registry hiding |

### IDT Analysis
Interrupt Descriptor Table maps interrupts to handler routines.
- INT 0x2E: Legacy system call entry (pre-SYSENTER)
- Modified IDT entries indicate kernel-level hooking

### IRP Hook Detection
```
# Check driver dispatch routines
volatility3 -f memory.dmp windows.driverirp

# For each driver, MajorFunction[IRP_MJ_*] should point within the driver's address range
# External pointers indicate IRP hooking
```

### Callback Analysis
Modern rootkits use legitimate callback mechanisms:
- PsSetCreateProcessNotifyRoutine — process creation monitoring
- PsSetLoadImageNotifyRoutine — image load monitoring
- CmRegisterCallbackEx — registry monitoring
- ObRegisterCallbacks — object access monitoring

## Linux Kernel Analysis

### System Call Table
```bash
# Check /proc/kallsyms for sys_call_table address
cat /proc/kallsyms | grep sys_call_table

# Compare system call addresses against known-good kernel
# Tools: volatility linux.check_syscall plugin
```

### Kernel Module Analysis
```bash
# List loaded modules
lsmod
cat /proc/modules

# Check module signatures (if enforced)
modinfo <module_name>

# Verify against known-good module list
```

### VFS Hooking
- Rootkits can hook Virtual File System operations
- Replace file_operations function pointers (readdir, iterate, iterate_shared)
- Detection: Verify VFS operation pointers against kernel text segment

## Memory Forensics Approach

### Process Scanning
```
# Multiple enumeration methods to detect DKOM
volatility3 -f memory.dmp windows.pslist    # ActiveProcessLinks traversal
volatility3 -f memory.dmp windows.psscan    # Pool tag scanning
volatility3 -f memory.dmp windows.pstree    # Process tree view

# Compare results — discrepancies indicate rootkit presence
```

### Module Scanning
```
volatility3 -f memory.dmp windows.modules   # PsLoadedModuleList traversal
volatility3 -f memory.dmp windows.modscan   # Pool tag scanning

# Hidden modules appear in modscan but not modules
```