Posted by Kristian Erik Hermansen on May 20
Has anyone tried this WindowsSCOPE hardware before? The video talks
about how they used it to detect/analyze Shadow Walker rootkit. Also,
seems you can make memory snapshots in time and see how kernel
SSDT/IDT ptrs change, among other things. Also shows colorized
differences in code pages between snapshots.
http://www.windowsscope.com/index.php?option=com_content&view=article&id=80&Itemid=49
I heard they are giving away free demo…
