Sdt Loader Online

When most people think of Windows kernel rootkits, they think of DKOM (Direct Kernel Object Manipulation) or SSDT hooking. But what if I told you that one of the most elegant persistence and execution primitives doesn't hook the System Service Dispatch Table (SSDT) at all—it replaces the loader ?

It doesn't fight PatchGuard. It evades it. sdt loader

; SDT Loader stub example (conceptual) mov rax, [rsp+8] ; retrieve syscall number cmp eax, CUSTOM_SYSCALL_NUMBER jne original_handler jmp my_payload_function original_handler: jmp [original_ssdt_entry] But modern variants don't even need a compare. Instead, they and route it to a dispatcher that parses a hidden command protocol. Why Not Hook the SSDT? Good question. Hooking is noisy. PatchGuard (Kernel Patch Protection) on x64 systems will happily bugcheck the system if it detects a modified SSDT entry. So how does an SDT loader survive? When most people think of Windows kernel rootkits,