Add detection of inline KiSystemService hooks about malwarecookbook

[GoogleCodeExporter]

Oops I forgot we already check for inline hooks of all IDT function addresses, 
including KiSystemService:

# python volatility.py idt -f rustock-b.vmem 

[...]

2A       KiGetTickCount             0x8053da0e   ntoskrnl.exe .text
2B       KiCallbackReturn           0x8053db10   ntoskrnl.exe .text
2C       KiSetLowWaitHighThread     0x8053dcb0   ntoskrnl.exe .text
2D       KiDebugService             0x8053e5f0   ntoskrnl.exe .text
2E       KiSystemService            0x806b01b8   ntoskrnl.exe .rsrc => JMP 
0xb17a2e45

Original comment by [email protected] on 10 Jan 2011 at 9:07

• Changed state: Fixed