[STRELiTZIA]

Hello,

What's new in v1.4.0 :
- Added plugins system
- Added support for windows server 2008, seven sp1
- Enhanced stability on NT 6.0+ (windows vista/seven)
- Improved driver scan
- Improved code hook scan
- Fixed bug prevent the tool from working on windows xp
- Fixed bug related to long paths
- Fixed bug in process/driver dumper
- Fixed bug in IDT scan

Download Link :
http://www.mediafire.com/?94hb182iirjpvcr

SHA-256 :
3C0D5426A2FE65EB72FB4F6A396C4CF83285B38EAE188B41C6 F8D048157FF6DF

I like: Added new plugins system and Script Engine.

Regards.

[Meriadoc]

Yes, nice additions :)

Kernel Detective is always in my 'tool kit', so I appreciate the update - thanks for a nice tool.

[EP_X0FF]

Hi,

nice release :)

here is bugreport

when trying to access callbacks program crashes.

Clean XP SP3

[STRELiTZIA]

Hi,

Hi,

nice release :)

here is bugreport

when trying to access callbacks program crashes.

Clean XP SP3

Bug reproduced successfully...

My Tests:
First test, Launch KDetective (viewing System Notify Callbacks without crash)
Second test: clear all callbacks... (Crash during cleaning)
Third test, Launch KDetective second time (Crash at viewing System Notify Callbacks)

- Tested on Win Xp SP3 + Windows 7.

Regards.

[Mehdi]

I got a BSOD on my Windows 7
DRIVER_IRQL_NOT_LESS_OR_EQUAL
(In the "Processes" tab, there was a process called "G" that its "Virtual Size" was 0 and its entry was red. I killed it; switched to other tabs, then again switched to "Processes" tab and got a BSOD)
(That "G" process had anything related to "Kernel Detective" ??
cause now (after reboot) I have something similar:

but other tools (Gmer, Xuetr, RKUnhooker don't show anything suspicious!)
I've attached output of "!analyze -v" and "whocrashed"

[GamingMasteR]

Thanks STR, Mehdi and EP_X0FF for testing .
I'll check the minidump and see if I can fix it soon :)

[Mehdi]

a very minor issue:
in "Drivers" tab, we can right-click on any entry, then "Properties" and we'll see the "Properties" of that driver file; but this operation doesn't work on some entries. For example in Windows XP SP2, "right click->Properties" on "devflt.sys" doesn't work (although, the file is in system32\drivers)
(these don't work either: disk.sys, dmio.sys, acpi.sys)

[STRELiTZIA]

Hi,

a very minor issue:
in "Drivers" tab, we can right-click on any entry, then "Properties" and we'll see the "Properties" of that driver file; but this operation doesn't work on some entries. For example in Windows XP SP2, "right click->Properties" on "devflt.sys" doesn't work (although, the file is in system32\drivers)
(these don't work either: disk.sys, dmio.sys, acpi.sys)

Yes, confirmed...
all driver names displayed without full path are affected...

E.g:
- C:\WINDOWS\System32\Drivers\Null.sys --> properties... ok
- pci.sys --> failed.

KDetective searchs "pci.sys" in "system32" folder but ignores "drivers" folder.

[Alex]

Thanks GamingMasteR for sharing!

I don't have any troubles with the new version - everything works well!

Alex

[GamingMasteR]

What's new in v1.4.1 :
- Fixed possible BSOD when scanning processes
- Fixed bug in callbacks scanning
- Enhanced showing files properties and signature verifying
- Skeleton SDK for VS2008 included


Download Link :
http://www.mediafire.com/?o4mwekn7jtizdi4


SHA-256 :
619E9AE64CC9DE82DD35CB3469D413E8C78A57EC8021B8450B6EAD15526562D7