The Rootkit Arsenal: Escape and Evasion in the Dark Corners of the System

Description

With the growing prevalence of the Internet, rootkit technology has taken center stage in the battle between White Hats and Black Hats. Adopting an approach that favors full disclosure, The Rootkit Arsenal presents the most accessible, timely, and complete coverage of rootkit technology. This book covers more topics, in greater depth, than any other currently available. In doing so, the author forges through the murky back alleys of the Internet, shedding light on material that has traditionally been poorly documented, partially documented, or intentionally undocumented.

Learn how to:

    * Hook kernel structures on multi-processor systems

    * Use a kernel debugger to reverse-engineer operating system internals

    * Inject call gates to create a back door into Ring-0

    * Use detour patches to sidestep group policy

    * Modify privilege levels on Windows Vista by altering kernel objects

    * Utilize bootkit technology

    * Defeat both live incident response and post-mortem forensic analysis

    * Implement code armoring to protect your deliverables

    * Establish covert network channels using the WSK and NDIS 6.0

The shell scripts and build files used to compile selected projects in this book can be downloaded from the book's resource page at www.wordware.com/RKArsenal.