drop apihooks ssdt volatility output or memory region · detect jmp patches and inline api hooks · classify hook destinations · export csv · runs locally
apihooks / memory
drop apihooks · ssdt · memory region
or click
Volatility apihooks / ssdt plugin output · raw DLL region for JMP prologue scan
drop apihooks · ssdt txt or memory region binary