skip to content
Professional rootkits Preview this item
ClosePreview this item
Checking...

Professional rootkits

Author: Ric Vieler
Publisher: Indianapolis, IN : Wiley Technology Pub., 2007.
Edition/Format:   Print book : EnglishView all editions and formats
Summary:

Whether you want to learn how to develop a robust, full-featured rootkit or you're looking for effective ways to prevent one from being installed on your network, this hands-on resource provides you  Read more...

Rating:

(not yet rated) 0 with reviews - Be the first.

Subjects
More like this

Find a copy in the library

&AllPage.SpinnerRetrieving; Finding libraries that hold this item...

Details

Document Type: Book
All Authors / Contributors: Ric Vieler
ISBN: 9780470101544 0470101547
OCLC Number: 804436795
Notes: A la port.: "programmer to progammer."
Description: XIX, 334 p. ; 24 cm
Contents: Introduction. Chapter 1: Tools. How Do I Build a Rootkit? The Microsoft Driver Development Kit. Microsoft Visual VC++ 2005 Express. Microsoft Software Developers Kit. Sysinternals Freeware. IDA. Debugging Tools for Windows. Verification. VCVARS32.BAT. Other Tools to Consider. What to Keep Out. Summary. Chapter 2: A Basic Rootkit. Ghost. Alternate Data Streams. Installing Your Rootkit. Testing Your Rootkit. Summary. Chapter 3: Kernel Hooks. The System Call Table. Kernel Memory Protection. Defining a Hook Function. An Example. hookManager.c. hookManager.h. What to Hook? Csr - Client Server Run Time. Dbg - Debug Manager. Etw - Event Tracing for Windows. Ki - Kernel (must be called from Kernel). Ldr - Loader Manager. Pfx - ANSI Prefix Manager. Rtl - Runtime Library. Zw - File and Registry. The Problem with Hooking. Summary. Chapter 4: User Hooks. Process Injection. Finding a Specific Dynamic Link Library. Defining a Hook Function. The Trampoline Function. An Example. Ghost.h. Ghost.c. hookManager.h. hookManager.c. injectManager.h. injectManager.c. parse86.h. parse86.c. peFormat.h. Using Ghost to Block PGP Encoding. Summary. Chapter 5: I/O Processing. Using DeviceIoControl. The Console Application. Controller.c. IoManager.h. buildController.bat. Handling IO within the Device Driver. IoManager.c. Injected Function Programming. Testing I/O Control. Summary. Chapter 6: Communications. The Transport Driver Interface. Initiating the Connection. An Example. commManager.h. commManager.c. Running the Example. Summary. Chapter 7: Filter Drivers. Inserting a Filter Driver. File Filtering. Network Filtering. Combined Filtering. An Example. filterManager.h. filterManager.c. Ghost.c. IoManager.h. IoManager.c. Summary. Chapter 8: Key Logging. Processing Levels. A Keyboard Filter. Threading and Synchronization. Interpreting Key Codes. An Example. SOURCES. Ghost.c. filterManager.c. filterManager.h. IoManager.c. keyManager.h. keyManager.c. OnKeyboardRead. OnReadCompletion. GetKey. InitializeLogThread. KeyLoggerThread. StartKeylogger. StopKeylogger. OnCancel. Testing the Example. Summary. Chapter 9: Concealment. Registry Key Hiding. registryManager.h. registryManager.c. Ghost.c. hookManager.h. hookManager.c. Directory Hiding. Process Hiding. HideMe.c. Testing Concealment. Summary. Chapter 10: E-mail Filtering. Microsoft Outlook E-mail Filtering. OutlookExtension.h. OutlookExtension.cpp. Installing an Outlook Client Filter. Testing the Outlook Client Extension. Lotus Notes E-mail Filtering. LotusExtension.h. LotusExtension.c. LotusExtension.def. LotusExtension.mak. readme.txt. Installing a Lotus Notes Client Filter. Testing the Lotus Notes Client Extension. Summary. Chapter 11: Installation Considerations. Intended Installation. Intended Installation Software. End User License Agreements (EULAs). Unintended Installation. Privilege Escalation. Persistence. ZwSetSystemInformation with SystemLoadAndCallImage. Registry Possibilities. Initialization Files. Installing onto Machines That Visit Your Website. Removing the Traces of an Installation. Testing Your Installation Techniques. Summary. Chapter 12: Ghost Tracker. The Controller. The Connection. Tamper Detection. An Example. GhostTracker.cs. ControlForm.cs. TargetController.cs. Listen.cs. GhostTracker. ControlForm. Summary. Chapter 13: Detecting Rootkits. Detection Methods. Detection Software. What to Do with a Detected Rootkit. Safe Mode. Summary. Chapter 14: Preventing Rootkits. Operating System Updates. Automatic Updates. Personal Firewalls. Free Personal Firewalls. Other Personal Firewalls. Host-based Intrusion Prevention Systems. Hardening. Virtualizing. Blocking Unexpected Operations. Rootkit Prevention Techniques. Summary. Appendix A: Freeware. Index.
Responsibility: Ric Vieler.

Reviews

User-contributed reviews
Retrieving GoodReads reviews...
Retrieving DOGObooks reviews...

Tags

Be the first.
Confirm this request

You may have already requested this item. Please select Ok if you would like to proceed with this request anyway.

Linked Data


Primary Entity

<http://www.worldcat.org/oclc/804436795> # Professional rootkits
    a schema:Book, schema:CreativeWork ;
    library:oclcnum "804436795" ;
    library:placeOfPublication <http://experiment.worldcat.org/entity/work/data/62829720#Place/indianapolis_in> ; # Indianapolis, IN
    library:placeOfPublication <http://id.loc.gov/vocabulary/countries/xxk> ;
    schema:about <http://experiment.worldcat.org/entity/work/data/62829720#Topic/ordinadors_control_d_acces> ; # Ordinadors--Control d'accés
    schema:about <http://experiment.worldcat.org/entity/work/data/62829720#Topic/seguretat_informatica> ; # Seguretat informàtica
    schema:about <http://experiment.worldcat.org/entity/work/data/62829720#Topic/microsoft_windows_fitxer_informatic> ; # Microsoft Windows (Fitxer informàtic)
    schema:bookFormat bgn:PrintBook ;
    schema:creator <http://viaf.org/viaf/43735167> ; # Ric Vieler
    schema:datePublished "2007" ;
    schema:exampleOfWork <http://worldcat.org/entity/work/id/62829720> ;
    schema:inLanguage "en" ;
    schema:name "Professional rootkits" ;
    schema:numberOfPages "334" ;
    schema:productID "804436795" ;
    schema:publication <http://www.worldcat.org/title/-/oclc/804436795#PublicationEvent/indianapolis_in_wiley_technology_pub_2007> ;
    schema:publisher <http://experiment.worldcat.org/entity/work/data/62829720#Agent/wiley_technology_pub> ; # Wiley Technology Pub.
    schema:workExample <http://worldcat.org/isbn/9780470101544> ;
    wdrs:describedby <http://www.worldcat.org/title/-/oclc/804436795> ;
    .


Related Entities

<http://experiment.worldcat.org/entity/work/data/62829720#Agent/wiley_technology_pub> # Wiley Technology Pub.
    a bgn:Agent ;
    schema:name "Wiley Technology Pub." ;
    .

<http://experiment.worldcat.org/entity/work/data/62829720#Place/indianapolis_in> # Indianapolis, IN
    a schema:Place ;
    schema:name "Indianapolis, IN" ;
    .

<http://experiment.worldcat.org/entity/work/data/62829720#Topic/microsoft_windows_fitxer_informatic> # Microsoft Windows (Fitxer informàtic)
    a schema:Intangible ;
    schema:name "Microsoft Windows (Fitxer informàtic)" ;
    .

<http://experiment.worldcat.org/entity/work/data/62829720#Topic/ordinadors_control_d_acces> # Ordinadors--Control d'accés
    a schema:Intangible ;
    schema:name "Ordinadors--Control d'accés" ;
    .

<http://experiment.worldcat.org/entity/work/data/62829720#Topic/seguretat_informatica> # Seguretat informàtica
    a schema:Intangible ;
    schema:name "Seguretat informàtica" ;
    .

<http://viaf.org/viaf/43735167> # Ric Vieler
    a schema:Person ;
    schema:birthDate "1960" ;
    schema:familyName "Vieler" ;
    schema:givenName "Ric" ;
    schema:name "Ric Vieler" ;
    .

<http://worldcat.org/isbn/9780470101544>
    a schema:ProductModel ;
    schema:isbn "0470101547" ;
    schema:isbn "9780470101544" ;
    .


Content-negotiable representations

Close Window

Please sign in to WorldCat 

Don't have an account? You can easily create a free account.