<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Detecting Rootkit Presence — API Reference

## Volatility 3 — Rootkit Detection Plugins

### Process Analysis

```bash
vol3 -f memory.dmp windows.pslist       # Standard EPROCESS traversal
vol3 -f memory.dmp windows.psscan       # Pool tag scan (finds unlinked)
vol3 -f memory.dmp windows.pstree       # Parent-child tree
vol3 -f memory.dmp linux.pslist         # Linux task_struct traversal
vol3 -f memory.dmp linux.pstree         # Linux process tree
```

### Hook Detection

```bash
vol3 -f memory.dmp windows.ssdt         # SSDT hook detection
vol3 -f memory.dmp windows.callbacks    # Kernel callback hooks
vol3 -f memory.dmp linux.check_syscall  # Syscall table verification
vol3 -f memory.dmp linux.check_idt      # IDT integrity check
```

### Module Analysis

```bash
vol3 -f memory.dmp windows.modules      # Loaded kernel modules
vol3 -f memory.dmp windows.modscan      # Module pool scan (hidden)
vol3 -f memory.dmp linux.lsmod          # Loaded LKMs
vol3 -f memory.dmp linux.hidden_modules # Hidden kernel modules
vol3 -f memory.dmp linux.check_modules  # Module integrity check
```

## rkhunter

```bash
rkhunter --update                        # Update signatures
rkhunter --propupd                       # Update file properties baseline
rkhunter --check                         # Full scan
rkhunter --check --skip-keypress         # Non-interactive
rkhunter --check --report-warnings-only  # Warnings only
rkhunter --check --rwo --logfile /var/log/rkhunter.log
```

## chkrootkit

```bash
chkrootkit                              # Full scan
chkrootkit -q                           # Quiet mode (infected only)
chkrootkit -x                           # Expert mode (verbose)
chkrootkit -r /mnt/suspect              # Scan alternate root
```

## Linux Kernel Module Tools

```bash
lsmod                                   # List loaded modules
modinfo <module_name>                   # Module metadata
modprobe -r <module_name>              # Remove module
cat /proc/modules                       # Raw module list
cat /proc/kallsyms | grep sys_call_table  # Syscall table address
```

## GMER (Windows)

```
gmer.exe                                # GUI — scans for:
                                        #   SSDT hooks
                                        #   IDT hooks
                                        #   Hidden processes
                                        #   Hidden services
                                        #   Hidden files
                                        #   Hidden drivers
                                        #   Hidden registry keys
```

## TDSSKiller (Windows)

```bash
TDSSKiller.exe -l log.txt -accepteula   # Full scan with logging
TDSSKiller.exe -qpath quarantine/       # Set quarantine path
TDSSKiller.exe -dcexact                 # Exact driver checking
```
