A way to restore the System Service Dispatch Table from user-space

Win32 kernel root kits modify the behavior of the system by hooking the entries within the kernel´s System Service Dispatch Table (SSDT). How to restore the SSDT modified by the malicious has become a very important issue to an administrator who would like to ensure the safe operation of the system. This article reviews the technique of kernel Native API hooking and proposes a way to restore the SSDT directly from user-space via devicephysical memory and do not require a kernel driver to be loaded. Security tools used the similar hooking technique to implement some of their security features should take additional steps to prevent the restoration of the SSDT entries.