Rootkits: Subverting the Windows Kernel
Understanding Attackers Motives
How Long Have Rootkits Been Around?
Rootkits and Software Exploits
Offensive Rootkit Technologies
Chapter 2. Subverting the Kernel
Introducing Code into the Kernel
Building the Windows Device Driver
Loading and Unloading the Driver
Fusion Rootkits: Bridging User and Kernel Modes
Decompressing the .sys File from a Resource
Chapter 3. The Hardware Connection
Tables, Tables, and More Tables
The Interrupt Descriptor Table
The System Service Dispatch Table
Chapter 4. The Age-Old Art of Hooking
The KLOG Rootkit: A Walk-through
Chapter 7. Direct Kernel Object Manipulation
Determining the Version of the Operating System
Communicating with the Device Driver from Userland
Token Privilege and Group Elevation with DKOM
Chapter 8. Hardware Manipulation
Example: Accessing the Keyboard Controller
How Low Can You Go? Microcode Update
Remote Command, Control, and Exfiltration of Data
Kernel TCP/IP Support for Your Rootkit Using TDI
Kernel TCP/IP Support for Your Rootkit Using NDIS