Rootkits: Subverting the Windows Kernel: Subverting the Windows Kernel

This book is a must have for anyone working in it security. it is a sort of dark knowledge of windows programming. it contain good examples on how to hide processes, hook anything in windows, hide files. i read it 3 times, highly recommended!

Great help

I had read this book with the intentions of gaining a better understanding how advanced malware works on the Windows OS. Coupled with Windows Internals, this book has given me a better knowledge of how deal with malware outbreaks at my job. This book provides you with code to build your own rudimentary rootkit, kind of a rootkit "Hello World" program. This book was published in 2005, so the rootkit design would be pre-Vista/Win7. Going from XP to Vista/Win7 represents a quantum leap in terms of resistance to malware, as a large number of security mechanisms were introduced since then, so I doubt the rootkit code would hold water today.However, this book is still a good read for a Windows administrator who wants to know how to better deal with malware outbreaks, and in gauging the potential impact on the enterprise.As for practical application; this book has helped me understand the analysis of a ZeroAccess persistent rootkit, something that I had been dealing with at work.[...]

Some may wonder if Hoglund and Butler are being irresponsible by writing a book that shows you how to bypass detection. If you look closely, however, you'll see that all of the methods they outline are detectable by current rootkit revealing mechanisms. And they also show you how to detect many new rootkits in the process. I consider this book to be a responsible contribution to the community, professionals and amateurs alike, in the finest tradition full disclosure.The book is organized into three major sections, even if it's not explicitly marked as such. The first section serves as an introduction to the topic and some of the high level concepts you'll need to know about Windows, control mechanisms, and where you can introduce your code. The second part is a highly technical tour of the techniques used to hook your rootkit in and hide it, And the third section is really one chapter covering detection of rootkits.The first few chapters, which serve to introduce the topic, get technical right away. Chapter 2, for example, shows you some basic mechanisms for hooking in your rootkit. If you're getting lost at this point, you'll want to probably augment your reading with a Win32 internals book. The resources listed by the authors, though, are great. By this point you can also see that the writing is clear and the examples contribute perfectly to the topic. Hardware hooking basics are covered in chapter 3, which should give you some indication of the book's pace (quick!).By the time you get to chapter 4 and discussing how to hook into both userland and the kernel, you're getting at some very valuable material. Although the book focuses on kernel hooking, a brief description of userland hooking is provided. Chapter 5 covers runtime patching, a black art that's not well known. This is almost worth the full price of admission, but the material gets even better.In chapters 6-9 you get into some serious deep voodoo and dark arts. In these chapters you'll learn the basics of direct kernel object manipulation, layered device drivers (which can save you a lot of work), hardware manipulation, and network handling. All of these are techniques used by rootkit authors to varying degrees and effect, so you should become familiar with them. The code examples are clear and functional, and you'll learn enough to write a basic rootkit in only about 150 pages. Simple keyboard sniffers and covert channels are described in the code examples. Useful stuff.I can't say I found many errors or nits in the book. There's some problems at times getting the code formatting just right, and what appear to be a few stray characters here and there, but nothing too obvious to me. Then again, I'm not a Windows kernel programmer, so I don't feel qualified to comment on the correctness of the code.In the finest tradition of using a blog and dynamic website to assist your readers, the authors have set up rootkit.com, which nicely supplements their book. Most of the resources they mention in the book are available here, as well as a great array of contributors and evolving techniques. Without the book the site is still useful, but together they're a great combination. Too many books lose their value once you read them, and some books stay with you because you're having difficulty understanding the authors. Rootkits will stay near you while you develop your skills because it's a lot of material in a small space, and although it's very clearly written, there is a deep amount of material to digest. You'll be working with this one for a while.My only major wish for this book is for it to have covered detection more significantly. One chapter covers how to detect rootkits, and although you may be able to look for some specific telltale signs of rootkits depending on how they were introduced, a more complete coverage of this approach would have made the book even more worthwhile.Rootkits is an invaluable contribution in the wider understanding of advanced attack and hacker techniques. Previously, much of this material was known to only a handful of people, and assembling your own knowledge base was difficult. Hoglund and Butler write clearly, use great code examples, and deliver an excellent book on a high technical and specialized topic. If you're interested in learning how to write your own rootkit or detect someone else's rootkit on your system, you should definitely start with this book.

Nice cover. Not recommended. Poorly written. Reads like a gamer wrote it, not a professional programmer. Neato ideas with a lot of fluff, no substance.

Technical books tend to be either "about things" or "how to do things" with how to being far rarer and generally more valuable. Hoglund and Butler are true authorities on this subject and yet they never brag, instead they focus on helping the rest of us understand what is possible and exactly how it can be done.Once again, the Addison-Wesley team demonstrates excellence, I found a couple of sentences that could benefit from a rewrite, but no grammar or spelling errors. The charts and code examples are done well and the layout never detracts from the message.I enjoyed learning about the VICE, patchfinder 2 and Rootkit Revealer tools and can't wait to run them on some of the older laptops in the company that have been used as loaners. I expect that will be revealing!This was the clearest explanation I have ever seen as to how networking is managed using the Transport Data Inferface. Even so, it still left me just a bit "hungry" and I hope this section is expanded in the second edition of this book.What impressed me the most though was when the authors reached the limits of their knowledge, after all, this is a developing art and no one understands everything, with areas such as microcode update they simply and frankly stated that.Clear, pragmatic, authoritative, what's not to like, buy this book.

The content is good, but it's a tough read. Even if you're experienced with Windows development and techniques that are used in the book, it's not an enjoyable read but more of a heavy slog. Many more texts are making infosec topics more approachable,. To be very honest I'd rather spend time with Windows Internals than this book, but that said it's a quality source on the subject topic hence the 4 stars.

Just another one of those proud owners of this book yes the price is very steep but dam the material ))) loving it

Rootkits are defined as a set of programs and code that allows a permanent or consistent, undetectable presence on a computer. The "root" denotes the all powerful superuser in the UNIX systems. Though no such account exists in windows the use rootkit applies to a piece of code that resides in the machine , which is generally undetectable and allows the owner of the code to have administrative rights on the windows machine on which it is running. Rootkits have been in prominence in the recent past due to the Sony's infamous DRM. Apparently that could be described as "benevolent" use of rootkits. This is one of the many first books to come on in the recent past. The knowledge of rootkits were not available to general public till recently. The book describes in detail the different classes of rootkits that could be found in windows operating system and their mechanism of operation. There still exists a vacuum of a book on rootkit in Unix operating systems. Rootkits were known to be more prevalent in Unix versions than windows systems. The book describes in detail the mechanisms of action of rootkits and does describe briefly the methods for detection of rootkits. The book has been an end result of the authors long interest in rootkits, the author has setup a website and forum named rootkit which bears the same name. The book looks at the possible ways of subverting the operating system. This includes looking at both the software and hardware methods that could be used. It also looks at the possible methods of detection and describes them in lesser details. Each of methods of subverting the operating is described in detail with sample pieces of code. The book should allow a reader with a reasonable knowledge of programming and windows architecture to create variants of rootkits described or create new ones.The concept of rootkits have been around in the unix world for a while. The generic concepts of rootkits have remained more or less the same over the past few years. The methods of operation of rootkits in windows might chance as a result of change in architecture to windows. This is especially relevant as the rootkits depend on windows device driver architecture, hence any changes in windows would make the techniques described in the book obsolete. Yet the generic methods that are described would remain valid.The book starts off with a chapter aptly titled Leave No Trace it goes on to give a brief description of how do rootkits works. The it continues with high level description on HIPS and NIDS and how those might detect a rootkilt. The chapter also have a short history of rootkits. The second chapter titled Subverting the Kernel starts of with an introduction into device drivers in windows. It goes on describe how compile device drivers and debug them. It also describes the process of loading and unloading device drivers (or rootkits). There is also a high level description of structure of rootkit.There has been quite a lot of talk about Covert Channels in the past. The authors too delve a bit into the possibility of using covert channels , the possible ways of using TCP/IP is discussed. The last chapter is dedicated to Rootkit Detection. The authors take a short description of methods for detecting rootkits. The detection of root kits by analysis of behavior looking at entries in registries and other methods. The rootkit.com is again referred here and resources discussed in the book could be found there.The book assumes a working knowledge of programming in C especially pointers, as code samples are written in C. For running the samples that comes along with the book, some of them would need a copy of device driver kit and a C compiler. It would also assume an idea of Windows device driver architecture, as it an understanding of the device driver architecture could come in handy. It is first of the books to appear solely devoted to rootkits, although some of it have been briefly discussed in some books notably Exploiting Software: How to Break Code, which shares one of the authors.The author assumes Intel architecture and windows operating system . The operating system recommended would be windows 2000 or later, the device driver architecture has undergone changes from windows 98 to windows 2000 and backward compatibility is not present.The book is very readable and the language is clear and lucid. The technical contents of the book are accurate. The samples that are included in the book are straightforward and easy to follow. The book is supplemented by rootkit.com with more samples and resources. The illustrations are used only in the places where it’s necessary and they are helpful in understanding the concepts described.

Great read, if your looking some in depth technical content read to stimulate the mind this will do it.

Product areived a bit earlier than expected and in a superb condition! Had the option to buy it used.