Windows内核回调与DKOM检测取证深度分析

dt('nt!_OBJECT_HEADER')
# +0x000 PointerCount      : Int4B
# +0x004 HandleCount      : Int4B
# +0x008 NextToFree       : Ptr64 Void
# +0x008 Lock             : Int8B
# +0x010 TypeIndex        : UChar
# +0x011 TraceFlags       : UChar
# +0x012 InfoMask         : UChar
# +0x013 Flags            : UChar
# +0x014 ObjectCreateInfo : Ptr64 _EX_OBJECT_CREATE_TYPE
# +0x018 QuotaBlockCharged : Ptr64 Void
# +0x01a SecurityDescriptor : Ptr64 Void
# +0x01c Body             : _QUAD

Get-WmiObject Win32_SystemDriver | Select-Object Name, PathName, State, StartMode | Format-Table -AutoSize

driverquery /v /fo list

Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Services" | ForEach-Object { $props = Get-ItemProperty $_.PSPath; [PSCustomObject]@{ Name = $_.PSChildName; Type = $props.Type; Start = $props.Start; ImagePath = $props.ImagePath } } | Where-Object { $_.Type -eq 1 } | Format-Table -AutoSize

void CallbackRoutine(
    _Inout_ PEPROCESS Process,
    _In_ HANDLE ProcessId,
    _Inout_opt_ PPS_CREATE_NOTIFY_INFO CreateInfo
);

!process 0 0

dd nt!PspCreateProcessNotifyRoutineCount L1

dq nt!PspCreateProcessNotifyRoutine L<count>

!drvobj \Driver\YourDriver 2

vol -f memory.dmp windows.callbacks

dq nt!PspCreateThreadNotifyRoutine L<count>

!thread -1 <tid>

lm m *

!vad <address> /p

typedef struct _PS_SET_LOAD_IMAGE_NOTIFY_ROUTINE {
    PSTR FullImageName;
    HANDLE ProcessId;
    PIMAGE_INFO ImageInfo;
} PS_SET_LOAD_IMAGE_NOTIFY_ROUTINE;

dq nt!PspLoadImageNotifyRoutine L<count>

!imgreloc ntoskrnl.exe

Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" | Where-Object { $_.Id -eq 7 } | Select-Object -First 20 | Format-List TimeCreated, Message

dq nt!CmpCallBackCount L1

dq nt!CmpCallBackVector L<count>

dq nt!ObpCallbackListHead L<count>

!obj \Callback\*

dq nt!FsNotificationListHead L<count>

!filters

fltmc instances

fltmc filters

.foreach (addr { dq nt!PspCreateProcessNotifyRoutine L<count> }) { lm m addr }

import volatility3.framework
from volatility3.framework import interfaces, symbols
from volatility3.framework.layers import intel

def enumerate_callbacks(context, config):
    layer_name = context.config['Intel32e.layer_name']
    kernel_symbol_space = context.config['Intel32e.symbol_files']

    ntoskrnl = context.modules[kernel_symbol_space]

    psp_create_process_notify_routine = ntoskrnl.get_symbol("nt!PspCreateProcessNotifyRoutine")
    psp_create_process_notify_routine_count = ntoskrnl.get_symbol("nt!PspCreateProcessNotifyRoutineCount")

    layer = context.layers[layer_name]

    count = layer.read(psp_create_process_notify_routine.address, 4)
    count_value = int.from_bytes(count, byteorder='little')

    callbacks = []
    for i in range(count_value):
        entry_addr = psp_create_process_notify_routine.address + (i * 8)
        entry_data = layer.read(entry_addr, 8)
        callback_addr = int.from_bytes(entry_data, byteorder='little')
        callback_addr &= ~0xF
        callbacks.append(callback_addr)

    return callbacks

PsActiveProcessHead → [EPROCESS_P1] → [EPROCESS_P2] → [EPROCESS_MALICIOUS] → [EPROCESS_P3] → PsActiveProcessHead

PsActiveProcessHead → [EPROCESS_P1] → [EPROCESS_P2] → [EPROCESS_P3] → PsActiveProcessHead
                                          ↓
                                    [EPROCESS_MALICIOUS] (不在链表中，但内存结构完整)

!process 0 0

!process 0 1

!process <malicious_pid> 0

dt nt!_EPROCESS ActiveProcessLinks

dq PsActiveProcessHead

.foreach (entry { dq PsActiveProcessHead L<count> }) { !process entry }

vol -f memory.dmp windows.pslist
vol -f memory.dmp windows.pstree
vol -f memory.dmp windows.psscan

import volatility3.framework
from volatility3.framework import interfaces
from volatility3.plugins.windows import pslist, psscan

def detect_dkom(context, config):
    pslist_plugin = pslist.PsList(context, config)
    psscan_plugin = psscan.PsScan(context, config)

    pslist_pids = set()
    for proc in pslist_plugin.list_processes():
        pslist_pids.add(proc.UniqueProcessId)

    psscan_pids = set()
    for proc in psscan_plugin.list_processes():
        psscan_pids.add(proc.UniqueProcessId)

    hidden_pids = psscan_pids - pslist_pids

    if hidden_pids:
        print(f"[DKOM ALERT] Hidden PIDs detected: {hidden_pids}")
        for pid in hidden_pids:
            for proc in psscan_plugin.list_processes():
                if proc.UniqueProcessId == pid:
                    print(f"  PID: {pid}, Name: {proc.ImageFileName}, CreateTime: {proc.CreateTime}")

    return hidden_pids

lm m *

!drvobj \Driver\* 2

dq nt!PsDriverDriverList L<count>

DumpIt.exe /OUTPUT memory.raw /NOKERNEL

sudo python3 volatility3/vol.py -f /dev/mem --profile=Win10x64_19041 windows.pslist

sudo python3 volatility3/vol.py -f /dev/mem --profile=Win10x64_19041 windows.netscan

<Sysmon schemaversion="4.90">
  <EventFiltering>
    <DriverLoad onmatch="include">
      <Rule groupRelation="or">
        <Hash condition="is not">SHA256:KNOWN_GOOD_HASH</Hash>
        <Signed condition="is">false</Signed>
      </Rule>
    </DriverLoad>
  </EventFiltering>
</Sysmon>

Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" | Where-Object { $_.Id -eq 6 } | Select-Object -First 30 | Format-List TimeCreated, Message

Get-CimInstance -ClassName MSFT_WDACSIPolicy -Namespace root\Microsoft\Windows\DeviceGuard

Get-ComputerInfo | Select-Object DeviceGuard*, HyperVisorPlatformSecurity*

Get-WinEvent -LogName "Microsoft-Windows-CodeIntegrity/Operational" | Where-Object { $_.Id -in @(3001, 3002, 3004, 3010) } | Select-Object -First 20 | Format-List TimeCreated, Id, Message

fltmc instances

fltmc filters

fltmc volumes

Get-WmiObject Win32_SystemDriver | Where-Object { $_.PathName -like "*fltMgr*" }

!filter

!filters

dt nt!_FLTMGR_GLOBALS

!drvobj \Driver\YourMinifilter 2

dt nt!_FLT_OPERATION_REGISTRATION

import volatility3.framework
from volatility3.framework.objects import Pointer, Object
from volatility3.framework.symbols import intel

def enumerate_minifilters(context, config):
    layer_name = config['Intel32e.layer_name']
    ntoskrnl = context.modules['ntkrnlmp.pdb']

    flt_globals_addr = ntoskrnl.get_symbol("nt!FltMgrGlobals")

    layer = context.layers[layer_name]

    flt_globals = layer.read(flt_globals_addr, 0x100)

    print("[*] Enumerating Minifilter instances from memory...")
    print("[*] Use 'fltmc instances' for user-space enumeration comparison")

!obj \Device

!obj \Driver

!obj \ObjectTypes

!obj \GLOBAL??

Get-WmiObject Win32_Device

dt nt!_OBJECT_TYPE

!object \ObjectTypes

dt nt!_OBJECT_TYPE_INITIALIZER

!token -n

!token <address>

dt nt!_TOKEN

.process /p <system_pid>

dt nt!_EPROCESS Token

import volatility3.framework
from volatility3.plugins.windows import pslist, tokens

def detect_token_tampering(context, config):
    pslist_plugin = pslist.PsList(context, config)
    tokens_plugin = tokens.Tokens(context, config)

    token_refs = {}
    for proc in pslist_plugin.list_processes():
        token = proc.Token
        token_addr = token.vol.offset

        if token_addr in token_refs:
            token_refs[token_addr].append(proc.UniqueProcessId)
        else:
            token_refs[token_addr] = [proc.UniqueProcessId]

    suspicious = {}
    for token_addr, pids in token_refs.items():
        if len(pids) > 1:
            token_obj = context.object(
                "nt!_TOKEN",
                layer_name=config['Intel32e.layer_name'],
                offset=token_addr
            )
            user_sid = token_obj.UserAndGroups.dereference()
            suspicious[token_addr] = {
                "pids": pids,
                "user": str(token_obj.User),
                "elevation": token_obj.Elevation
            }

    return suspicious

.foreach (callback { dq nt!PspCreateProcessNotifyRoutine L<callback_count> }) { lm m callback }

.foreach (callback { dq nt!PspLoadImageNotifyRoutine L<callback_count> }) { lm m callback }

.foreach (callback { dq nt!PspCreateThreadNotifyRoutine L<callback_count> }) { lm m callback }

!ioapic

rdmsr 0x1d9

rdmsr 0xc0000080

title: Suspicious Kernel Callback Registration
id: 7a4b8c2d-1e3f-4a5b-9c6d-2f8e7a1b3c5d
status: experimental
description: Detects suspicious kernel callback registrations that may indicate rootkit activity
references:
  - https://attack.mitre.org/techniques/T1014/
  - https://attack.mitre.org/techniques/T1055/
author: x7peeps
date: 2026/07/13
modified: 2026/07/13
tags:
  - attack.defense_evasion
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1014
  - attack.t1055
logsource:
  product: windows
  service: sysmon
detection:
  selection_driver_load:
    EventID: 6
    Signed: "false"
  selection_driver_load_unsigned_detail:
    EventID: 6
    SignatureStatus: "Unsigned"
  selection_service_install:
    EventID: 7045
    ServiceType: "kernel mode driver"
  selection_code_integrity:
    EventID: 3001
  condition: selection_driver_load | selection_service_install | selection_code_integrity
falsepositives:
  - Legitimate driver updates from vendor
  - Custom in-house drivers during development
level: high

title: Potential DKOM Process Hiding
id: 9f3e2d1c-4b5a-8e7f-0a1b-2c3d4e5f6a7b
status: experimental
description: Detects potential DKOM-based process hiding by comparing multiple process enumeration methods
references:
  - https://attack.mitre.org/techniques/T1014/
author: x7peeps
date: 2026/07/13
tags:
  - attack.defense_evasion
  - attack.t1014
logsource:
  product: windows
  service: sysmon
detection:
  selection_process_create:
    EventID: 1
  selection_driver_load:
    EventID: 6
    Signed: "false"
  selection_network_connection:
    EventID: 3
  condition: selection_driver_load and selection_network_connection
falsepositives:
  - Network monitoring tools with kernel drivers
level: critical

function Get-KernelCallbackAudit {
    [CmdletBinding()]
    param()

    $results = @()

    Write-Host "[*] Enumerating kernel modules via DriverQuery..." -ForegroundColor Cyan
    $drivers = driverquery /v /fo csv | ConvertFrom-Csv
    Write-Host "[+] Found $($drivers.Count) loaded drivers" -ForegroundColor Green

    Write-Host "[*] Enumerating driver services from registry..." -ForegroundColor Cyan
    $servicePath = "HKLM:\SYSTEM\CurrentControlSet\Services"
    $driverServices = Get-ChildItem $servicePath | Where-Object {
        (Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue).Type -eq 1
    }
    Write-Host "[+] Found $($driverServices.Count) driver services" -ForegroundColor Green

    Write-Host "[*] Checking for unsigned drivers..." -ForegroundColor Cyan
    foreach ($driver in $drivers) {
        $driverPath = $driver.'Module Path'
        if (Test-Path $driverPath) {
            $sig = Get-AuthenticodeSignature $driverPath
            if ($sig.Status -ne "Valid") {
                $results += [PSCustomObject]@{
                    Driver    = $driver.Module
                    Path      = $driverPath
                    Status    = $sig.Status
                    Signer    = $sig.SignerCertificate.Subject
                    Threat    = "UNSIGNED_DRIVER"
                    Severity  = "HIGH"
                }
                Write-Host "[!] UNSIGNED: $($driver.Module) at $driverPath" -ForegroundColor Red
            }
        }
    }

    Write-Host "[*] Checking for driver discrepancies..." -ForegroundColor Cyan
    $loadedDrivers = $drivers | ForEach-Object { $_.Module -replace "\.sys$", "" }
    $serviceNames = $driverServices | ForEach-Object { $_.PSChildName }

    $missingFromLoad = $serviceNames | Where-Object { $_ -notin $loadedDrivers }
    foreach ($missing in $missingFromLoad) {
        $svcProps = Get-ItemProperty "$servicePath\$missing" -ErrorAction SilentlyContinue
        if ($svcProps.Start -eq 0) {
            $results += [PSCustomObject]@{
                Driver    = $missing
                Path      = $svcProps.ImagePath
                Status    = "ServiceExists_NotLoaded"
                Signer    = "N/A"
                Threat    = "DKOM_SUSPECT"
                Severity  = "MEDIUM"
            }
            Write-Host "[?] $missing exists as service but not in loaded modules" -ForegroundColor Yellow
        }
    }

    Write-Host "`n[*] Checking Sysmon driver load events..." -ForegroundColor Cyan
    try {
        $sysmonEvents = Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 200 -ErrorAction SilentlyContinue |
            Where-Object { $_.Id -eq 6 }
        foreach ($event in $sysmonEvents) {
            $xml = [xml]$event.ToXml()
            $signed = $xml.Event.EventData.Data | Where-Object { $_.Name -eq "Signed" }
            $driverLoaded = $xml.Event.EventData.Data | Where-Object { $_.Name -eq "ImageLoaded" }
            if ($signed -and $signed."#text" -eq "false") {
                $results += [PSCustomObject]@{
                    Driver    = [System.IO.Path]::GetFileName($driverLoaded."#text")
                    Path      = $driverLoaded."#text"
                    Status    = "SysmonReportedUnsigned"
                    Signer    = "N/A"
                    Threat    = "SYSMON_UNSIGNED"
                    Severity  = "HIGH"
                }
                Write-Host "[!] Sysmon: Unsigned driver loaded: $($driverLoaded."#text")" -ForegroundColor Red
            }
        }
    } catch {
        Write-Host "[-] Sysmon not available or access denied" -ForegroundColor Yellow
    }

    Write-Host "`n[*] Checking Minifilter instances..." -ForegroundColor Cyan
    try {
        $minifilters = fltmc instances 2>$null
        Write-Host $minifilters -ForegroundColor Gray
    } catch {
        Write-Host "[-] fltmc not available" -ForegroundColor Yellow
    }

    Write-Host "`n[*] Checking for test signing mode..." -ForegroundColor Cyan
    $bcd = bcdedit /enum {current} 2>$null
    if ($bcd -match "testsigning\s+Yes") {
        $results += [PSCustomObject]@{
            Driver    = "SYSTEM"
            Path      = "bcdedit"
            Status    = "TestSigningEnabled"
            Signer    = "N/A"
            Threat    = "DSE_BYPASS"
            Severity  = "CRITICAL"
        }
        Write-Host "[!!!] TEST SIGNING MODE IS ENABLED!" -ForegroundColor Red
    }

    if ($results.Count -gt 0) {
        Write-Host "`n[*] Generating report..." -ForegroundColor Cyan
        $results | Format-Table -AutoSize
        $results | Export-Csv -Path "kernel_audit_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
        Write-Host "[+] Report saved" -ForegroundColor Green
    } else {
        Write-Host "`n[+] No suspicious kernel findings detected" -ForegroundColor Green
    }

    return $results
}

Get-KernelCallbackAudit

#!/usr/bin/env bash

set -euo pipefail

OUTPUT_DIR="kernel_forensics_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$OUTPUT_DIR"

echo "[*] Windows Kernel Forensics Remote Collector"
echo "[*] Output directory: $OUTPUT_DIR"

collect_driver_info() {
    echo "[*] Collecting driver information..."

    powershell.exe -Command "driverquery /v /fo csv" > "$OUTPUT_DIR/drivers.csv"

    powershell.exe -Command "
        Get-WmiObject Win32_SystemDriver |
        Select-Object Name, DisplayName, PathName, State, StartMode, ServiceType |
        ConvertTo-Csv -NoTypeInformation
    " > "$OUTPUT_DIR/system_drivers.csv"

    powershell.exe -Command "
        Get-ChildItem 'HKLM:\SYSTEM\CurrentControlSet\Services' |
        ForEach-Object {
            \$props = Get-ItemProperty \$_.PSPath -ErrorAction SilentlyContinue
            if (\$props.Type -eq 1) {
                [PSCustomObject]@{
                    Name = \$_.PSChildName
                    ImagePath = \$props.ImagePath
                    Start = \$props.Start
                    Group = \$props.Group
                }
            }
        } | ConvertTo-Csv -NoTypeInformation
    " > "$OUTPUT_DIR/driver_services.csv"

    echo "[+] Driver information collected"
}

collect_minifilter_info() {
    echo "[*] Collecting Minifilter information..."

    powershell.exe -Command "fltmc instances" > "$OUTPUT_DIR/minifilter_instances.txt"
    powershell.exe -Command "fltmc filters" > "$OUTPUT_DIR/minifilter_filters.txt"
    powershell.exe -Command "fltmc volumes" > "$OUTPUT_DIR/minifilter_volumes.txt"

    echo "[+] Minifilter information collected"
}

collect_signature_audit() {
    echo "[*] Auditing driver signatures..."

    powershell.exe -Command "
        \$drivers = driverquery /fo csv | ConvertFrom-Csv
        foreach (\$d in \$drivers) {
            \$path = \$d.'Module Path'
            if (Test-Path \$path) {
                \$sig = Get-AuthenticodeSignature \$path -ErrorAction SilentlyContinue
                [PSCustomObject]@{
                    Driver = \$d.Module
                    Path = \$path
                    Status = \$sig.Status
                    Signer = if (\$sig.SignerCertificate) { \$sig.SignerCertificate.Subject } else { 'N/A' }
                }
            }
        } | ConvertTo-Csv -NoTypeInformation
    " > "$OUTPUT_DIR/signature_audit.csv"

    echo "[+] Signature audit completed"
}

collect_event_logs() {
    echo "[*] Collecting kernel-related event logs..."

    powershell.exe -Command "
        Get-WinEvent -LogName 'Microsoft-Windows-Sysmon/Operational' -MaxEvents 500 -ErrorAction SilentlyContinue |
        Where-Object { \$_.Id -in @(6, 7, 22) } |
        Select-Object TimeCreated, Id, LevelDisplayName, Message |
        Format-List
    " > "$OUTPUT_DIR/sysmon_events.txt"

    powershell.exe -Command "
        Get-WinEvent -LogName 'Microsoft-Windows-CodeIntegrity/Operational' -MaxEvents 200 -ErrorAction SilentlyContinue |
        Select-Object TimeCreated, Id, Message |
        Format-List
    " > "$OUTPUT_DIR/codeintegrity_events.txt"

    powershell.exe -Command "
        Get-WinEvent -LogName System -MaxEvents 1000 -ErrorAction SilentlyContinue |
        Where-Object { \$_.Id -eq 7045 } |
        Select-Object TimeCreated, Message |
        Format-List
    " > "$OUTPUT_DIR/service_install_events.txt"

    echo "[+] Event logs collected"
}

collect_bcdedit_info() {
    echo "[*] Checking boot configuration..."

    powershell.exe -Command "bcdedit /enum all" > "$OUTPUT_DIR/bcdedit_all.txt"
    powershell.exe -Command "bcdedit /enum {current}" > "$OUTPUT_DIR/bcdedit_current.txt"

    echo "[+] Boot configuration collected"
}

compare_driver_sources() {
    echo "[*] Comparing driver sources for DKOM detection..."

    powershell.exe -Command "
        \$loaded = (driverquery /fo csv | ConvertFrom-Csv).'Module Name' | Sort-Object
        \$services = Get-ChildItem 'HKLM:\SYSTEM\CurrentControlSet\Services' |
            Where-Object { (Get-ItemProperty \$_.PSPath -ErrorAction SilentlyContinue).Type -eq 1 } |
            ForEach-Object { \$_.PSChildName -replace '\.sys\$','' } | Sort-Object

        Write-Host '=== Loaded but not in services ==='
        \$loaded | Where-Object { \$_ -notin \$services }

        Write-Host '=== In services but not loaded ==='
        \$services | Where-Object { \$_ -notin \$loaded }
    " > "$OUTPUT_DIR/driver_comparison.txt"

    echo "[+] Driver source comparison completed"
}

main() {
    collect_driver_info
    collect_minifilter_info
    collect_signature_audit
    collect_event_logs
    collect_bcdedit_info
    compare_driver_sources

    echo "[*] Packing results..."
    tar -czf "${OUTPUT_DIR}.tar.gz" "$OUTPUT_DIR"
    echo "[+] Results packaged: ${OUTPUT_DIR}.tar.gz"
    echo "[+] Collection complete"
}

main "$@"

import struct
import sys
import json
from datetime import datetime

class KernelCallbackAnalyzer:

    CALLBACK_TYPES = {
        "PspCreateProcessNotifyRoutine": "Process Creation",
        "PspCreateThreadNotifyRoutine": "Thread Creation",
        "PspLoadImageNotifyRoutine": "Image Load",
        "CmpCallbackVector": "Registry Operation",
        "ObpCallbackListHead": "Object Operation",
        "FsNotificationListHead": "Filesystem Registration"
    }

    KNOWN_DRIVERS = {
        "ntoskrnl.exe": "Windows Kernel",
        "hal.dll": "Hardware Abstraction Layer",
        "fltmgr.sys": "Filter Manager",
        "CI.dll": "Code Integrity",
        "mssecex.sys": "Microsoft Security",
        "wdboot.sys": "Windows Defender Boot",
        "WdFilter.sys": "Windows Defender Filter",
    }

    def __init__(self, memory_dump_path):
        self.memory_dump_path = memory_dump_path
        self.findings = []
        self.timestamps = []

    def analyze_callback_registry(self, callback_table, callback_count, callback_type):
        print(f"[*] Analyzing {callback_type} ({callback_count} registered callbacks)...")

        results = {
            "type": callback_type,
            "count": callback_count,
            "callbacks": [],
            "anomalies": []
        }

        for i in range(callback_count):
            entry_addr = callback_table + (i * 8)
            raw_data = self.read_memory(entry_addr, 8)
            if raw_data is None:
                results["anomalies"].append({
                    "address": hex(entry_addr),
                    "type": "READ_ERROR",
                    "severity": "HIGH"
                })
                continue

            callback_addr = struct.unpack("<Q", raw_data)[0]
            callback_addr &= ~0xF

            module_name = self.resolve_module(callback_addr)
            is_known = module_name in self.KNOWN_DRIVERS

            callback_info = {
                "index": i,
                "address": hex(callback_addr),
                "module": module_name,
                "known": is_known
            }
            results["callbacks"].append(callback_info)

            if not is_known:
                results["anomalies"].append({
                    "address": hex(callback_addr),
                    "type": "UNKNOWN_MODULE",
                    "severity": "HIGH",
                    "detail": f"Callback points to unknown module at {hex(callback_addr)}"
                })

        return results

    def read_memory(self, address, size):
        try:
            with open(self.memory_dump_path, 'rb') as f:
                f.seek(address)
                return f.read(size)
        except (IOError, OSError):
            return None

    def resolve_module(self, address):
        module_bases = {
            0xfffff80000000000: "ntoskrnl.exe",
            0xfffff80040000000: "hal.dll",
            0xfffff80041000000: "fltmgr.sys",
        }
        for base, name in module_bases.items():
            if base <= address < base + 0x01000000:
                return name
        return "UNKNOWN"

    def generate_report(self):
        report = {
            "analysis_time": datetime.now().isoformat(),
            "memory_dump": self.memory_dump_path,
            "findings": self.findings,
            "summary": {
                "total_anomalies": sum(len(f.get("anomalies", [])) for f in self.findings),
                "total_callbacks": sum(f.get("count", 0) for f in self.findings)
            }
        }
        return json.dumps(report, indent=2)


if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <memory_dump_path>")
        sys.exit(1)

    analyzer = KernelCallbackAnalyzer(sys.argv[1])
    print(f"[*] Memory dump: {sys.argv[1]}")
    print(f"[*] Use WinDbg or Volatility 3 to extract callback addresses first")
    print(f"[*] Example: vol -f {sys.argv[1]} windows.callbacks")