偶然的机会试了一下大神的rootkit扫描工具，启动时竟然直接崩溃，break进了windbg：
(36cc.328): Access violation - code c0000005 (!!! second chance !!!)
*** ERROR: Module load completed but symbols could not be loaded for C:\Users\ge\Downloads\RootkitRevealer.exe
eax=ffffffff ebx=004aa634 ecx=c0100000 edx=0019f1fc esi=00000000 edi=02fc0048
eip=004040cd esp=0019f1ec ebp=0019f1f0 iopl=0 nv up ei ng nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010286
RootkitRevealer+0x40cd:
004040cd cd2e int 2Eh
仔细一看，原来是使用int 2e强调内核服务：
0:000> ub
RootkitRevealer+0x40bd:
004040bd 90 nop
004040be 90 nop
004040bf 90 nop
004040c0 55 push ebp
004040c1 8bec mov ebp,esp
004040c3 51 push ecx
004040c4 8b4508 mov eax,dword ptr [ebp+8]
004040c7 8d950c000000 lea edx,[ebp+0Ch]
0:000> u
RootkitRevealer+0x40cd:
004040cd cd2e int 2Eh
004040cf 8945fc mov dword ptr [ebp-4],eax
004040d2 8b45fc mov eax,dword ptr [ebp-4]
004040d5 8be5 mov esp,ebp
004040d7 5d pop ebp
004040d8 c3 ret
004040d9 90 nop
004040da 90 nop