[Fyyre]

DrvMon v1.2
by Fyyre & EP_X0FF

DrvMon tool monitors the system for new drivers and saves them to a directory of your choice.

We created this to make easy saving drivers from certain types of rootkit malware, which
erase the driver immediately after loading.

Updated to version 1.2 (is attached).

[NOP]

Great work guys, grabs TDL driver nicely. :D

[Meriadoc]

Thanks guys nice work, less trouble :) works well.

[EP_X0FF]

Thanks :) We did it long time ago to save some time while reversing rootkits.
If you will find any bugs - please report we will try to fix them asap.

[STRELiTZIA]

Very usefull tool, thanks :)

We did it long time ago to save some time while reversing rootkits

And me the poor who pause each time a breakpoint at: CreateFileA, WriteFile to catch rootkits driver :(

[Brookit]

Useful and handy tool, thank you.

Same driver twice in file? Intended?

[EP_X0FF]

Yes, same named drivers will be dumped to one file. This can be changed in next version :)

[Dreg]

Nice work guys!

[__Genius__]

Hi, Good job, thanks Fyyre & EP_X0FF .
worth to catch malwares ;)

[Vrtule]

Hello,

that's nice tool. I previously used SSDT hook on NtLoadDriver to catch drivers being loated. The hook handler called KeDelayExecutionThread and waited for a few seconds, so I have a chance to copy driver file to a safe place .