Professional Rootkits

Introduction.Chapter 1: Tools.How Do I Build a Rootkit?The Microsoft Driver Development Kit.Microsoft Visual VC++ 2005 Express.Microsoft Software Developers Kit.Sysinternals Freeware.IDA.Debugging Tools for Windows.Verification.VCVARS32.BAT.Other Tools to Consider.What to Keep Out.Summary.Chapter 2: A Basic Rootkit.Ghost.Alternate Data Streams.Installing Your Rootkit.Testing Your Rootkit.Summary.Chapter 3: Kernel Hooks.The System Call Table.Kernel Memory Protection.Defining a Hook Function.An Example.hookManager.c.hookManager.h.What to Hook?Csr -- Client Server Run Time.Dbg -- Debug Manager.Etw -- Event Tracing for Windows.Ki -- Kernel (must be called from Kernel).Ldr -- Loader Manager.Pfx -- ANSI Prefix Manager.Rtl -- Runtime Library.Zw -- File and Registry.The Problem with Hooking.Summary.Chapter 4: User Hooks.Process Injection.Finding a Specific Dynamic Link Library.Defining a Hook Function.The Trampoline Function.An Example.Ghost.h.Ghost.c.hookManager.h.hookManager.c.injectManager.h.injectManager.c.parse86.h.parse86.c.peFormat.h.Using Ghost to Block PGP Encoding.Summary.Chapter 5: I/O Processing.Using DeviceIoControl.The Console Application.Controller.c.IoManager.h.buildController.bat.Handling IO within the Device Driver.IoManager.c.Injected Function Programming.Testing I/O Control.Summary.Chapter 6: Communications.The Transport Driver Interface.Initiating the Connection.An Example.commManager.h.commManager.c.Running the Example.Summary.Chapter 7: Filter Drivers.Inserting a Filter Driver.File Filtering.Network Filtering.Combined Filtering.An Example.filterManager.h.filterManager.c.Ghost.c.IoManager.h.IoManager.c.Summary.Chapter 8: Key Logging.Processing Levels.A Keyboard Filter.Threading and Synchronization.Interpreting Key Codes.An Example.SOURCES.Ghost.c.filterManager.c.filterManager.h.IoManager.c.keyManager.h.keyManager.c.OnKeyboardRead.OnReadCompletion.GetKey.InitializeLogThread.KeyLoggerThread.StartKeylogger.StopKeylogger.OnCancel.Testing the

Ric Vieler is a software engineer and a certified ethical hacker. He enjoys writing both technical manuals (such as Professional Rootkits) and science fiction novels (such as Spliced, Acknowledge, and A Stitch in Time). His love of the unexplored, mixed with a thorough understanding of computer internals, has culminated in a career that fully embraces both: professional hacking. When not hacking, reading, or writing, Ric spends his spare time with his wife, Lisa, and their two children, Samantha and Dylan.