Checking ntoskrnl for rootkit

This is not new, but I needed it the other day and wanted to post it here for memory. In Microsoft's kernel debugger tool 'kd' the following command checks for binary corruption in every loaded module.  Note also that you can do this with Sysinternal's 'LiveKd' for easier on the fly debugging.

kd> !for_each_module !chkimg @#ModuleName

Make sure you have trusted modules to compare against first. And point to them before running the above command with:

kd> .exepath c:Windowssystem32