Rootkit samples are usually drivers that implement the traditional MZ-PE structure with the IMAGE_SUBSYSTEM_NATIVE (1) value specified in the subsystem field of the IMAGE_OPTIONAL_HEADER32 structure. They use the usual x86 or x64 instructions that we are already familiar with. Thus, any tool (excluding user-mode debuggers such as OllyDbg) supporting them should handle rootkits without any major problems. Examples of them include tools such as IDA, radare2, and many others. Additionally, IDA plugins such as win_driver_plugin and DriverBuddy can be very useful for standard operations, such as decoding the IOCTL codes involved.
![country flag](/images/countries/us.png)
![country flag](/images/countries/gb.png)
![country flag](/images/countries/india.png)
![country flag](/images/countries/germany.png)
![country flag](/images/countries/france.png)
![country flag](/images/countries/canada.png)
![country flag](/images/countries/russia.png)
![country flag](/images/countries/spain.png)
![country flag](/images/countries/brazil.png)
![country flag](/images/countries/australia.png)
![country flag](/images/countries/singapore.png)
![country flag](/images/countries/hungary.png)
![country flag](/images/countries/ukraine.png)
![country flag](/images/countries/lux.png)
![country flag](/images/countries/estonia.png)
![country flag](/images/countries/lithuania.png)
![country flag](/images/countries/southkorea.png)
![country flag](/images/countries/turkey.png)
![country flag](/images/countries/switzerland.png)
![country flag](/images/countries/colombia.png)
![country flag](/images/countries/taiwan.png)
![country flag](/images/countries/chile.png)
![country flag](/images/countries/norway.png)
![country flag](/images/countries/ecuador.png)
![country flag](/images/countries/indonesia.png)
![country flag](/images/countries/newzealand.png)
![country flag](/images/countries/cyprus.png)
![country flag](/images/countries/denmark.png)
![country flag](/images/countries/finland.png)
![country flag](/images/countries/poland.png)
![country flag](/images/countries/malta.png)
![country flag](/images/countries/czech.png)
![country flag](/images/countries/austria.png)
![country flag](/images/countries/sweden.png)
![country flag](/images/countries/italy.png)
![country flag](/images/countries/egypt.png)
![country flag](/images/countries/belgium.png)
![country flag](/images/countries/portugal.png)
![country flag](/images/countries/slovenia.png)
![country flag](/images/countries/ireland.png)
![country flag](/images/countries/romania.png)
![country flag](/images/countries/greece.png)
![country flag](/images/countries/argentina.png)
![country flag](/images/countries/netherlands.png)
![country flag](https://cdn.packtpub.com/flag/004da5c4-583f-4e69-a0a8-0e999f350f90_128px-Flag_of_Bulgaria.png)
![country flag](/images/countries/latvia.png)
![country flag](/images/countries/southafrica.png)
![country flag](/images/countries/malaysia.png)
![country flag](/images/countries/japan.png)
![country flag](/images/countries/slovakia.png)
![country flag](/images/countries/philippines.png)
![country flag](/images/countries/mexico.png)
![country flag](/images/countries/thailand.png)