Once we know how rootkits work, it becomes possible to analyze them. The first thing worth mentioning is that not all kernel-mode malware families hide the presence of actual payloads. In fact, some of them can perform malicious actions on their own as well. In this section, we will familiarize ourselves with tools that can facilitate the rootkit analysis with an aim to understand malware functionalities and to learn some particular usage-related nuances.
Static and dynamic analysis in kernel mode
Static analysis
It always makes sense to start from static analysis, especially if the debugging setup is not available straight away. In some cases, it is possible to perform both static and dynamic analysis using the same tools.
...
