Hi there
I'm wondering how tools like RKU, Kernel Detective, etc are retrieving list of unloaded drivers? Are they using 'MmUnloadedDrivers' kernel variable? Or does some another options exist? And does structure of this objects (unloaded modules) similar to well-known structure '_(K)LDR_DATA_TABLE_ENTRY'?
Thanks.
I'm wondering how tools like RKU, Kernel Detective, etc are retrieving list of unloaded drivers? Are they using 'MmUnloadedDrivers' kernel variable? Or does some another options exist? And does structure of this objects (unloaded modules) similar to well-known structure '_(K)LDR_DATA_TABLE_ENTRY'?
Thanks.