Cover image for Rootkits : subverting the windows kernel
Rootkits : subverting the windows kernel
Personal Author:
Publication Information:
Upper Saddle River, NJ : Addison Wesley, 2006
Physical Description:
xxiii, 324 p. : ill. ; 23 cm.
Added Author:


Item Barcode
Call Number
Material Type
Item Category 1
30000010183966 QA76.9.A25 H64 2006 Open Access Book Book

On Order



"It''s imperative that everybody working in the field of cyber-security read this book to understand the growing threat of rootkits."
--Mark Russinovich, editor, Windows IT Pro / Windows & .NET Magazine

"This material is not only up-to-date, it defines up-to-date. It is truly cutting-edge. As the only book on the subject, Rootkits will be of interest to any Windows security researcher or security programmer. It''s detailed, well researched and the technical information is excellent. The level of technical detail, research, and time invested in developing relevant examples is impressive. In one word: Outstanding."
--Tony Bautts, Security Consultant; CEO, Xtivix, Inc.

"This book is an essential read for anyone responsible for Windows security. Security professionals, Windows system administrators, and programmers in general will want to understand the techniques used by rootkit authors. At a time when many IT and security professionals are still worrying about the latest e-mail virus or how to get all of this month''s security patches installed, Mr. Hoglund and Mr. Butler open your eyes to some of the most stealthy and significant threats to the Windows operating system. Only by understanding these offensive techniques can you properly defend the networks and systems for which you are responsible."
--Jennifer Kolde, Security Consultant, Author, and Instructor

"What''s worse than being owned? Not knowing it. Find out what it means to be owned by reading Hoglund and Butler''s first-of-a-kind book on rootkits. At the apex the malicious hacker toolset--which includes decompilers, disassemblers, fault-injection engines, kernel debuggers, payload collections, coverage tools, and flow analysis tools--is the rootkit. Beginning where Exploiting Software left off, this book shows how attackers hide in plain sight.

"Rootkits are extremely powerful and are the next wave of attack technology. Like other types of malicious code, rootkits thrive on stealthiness. They hide away from standard system observers, employing hooks, trampolines, and patches to get their work done. Sophisticated rootkits run in such a way that other programs that usually monitor machine behavior can''t easily detect them. A rootkit thus provides insider access only to people who know that it is running and available to accept commands. Kernel rootkits can hide files and running processes to provide a backdoor into the target machine.

"Understanding the ultimate attacker''s tool provides an important motivator for those of us trying to defend systems. No authors are better suited to give you a detailed hands-on understanding of rootkits than Hoglund and Butler. Better to own this book than to be owned."
--Gary McGraw, Ph.D., CTO, Cigital, coauthor of Exploiting Software (2004) and Building Secure Software (2002), both from Addison-Wesley

"Greg and Jamie are unquestionably the go-to experts when it comes to subverting the Windows API and creating rootkits. These two masters come together to pierce the veil of mystery surrounding rootkits, bringing this information out of the shadows. Anyone even remotely interested in security for Windows systems, including forensic analysis, should include this book very high on their must-read list."
--Harlan Carvey, author of Windows Forensics and Incident Recovery (Addison-Wesley, 2005)

Rootkits are the ultimate backdoor, giving hackers ongoing and virtually undetectable access to the systems they exploit. Now, two of the world''s leading experts have written the first comprehensive guide to rootkits: what they are, how they work, how to build them, and how to detect them.''s Greg Hoglund and James Butler created and teach Black Hat''s legendary course in rootkits. In this book, they reveal never-before-told offensive aspects of rootkit technology--learn how attackers can get in and stay in for years, without detection.

Hoglund and Butler show exactly how to subvert the Windows XP and Windows 2000 kernels, teaching concepts that are easily applied to virtually any modern operating system, from Windows Server 2003 to Linux and UNIX. They teach rootkit programming techniques that can be used for a wide range of software, from white hat security tools to operating system drivers and debuggers.

After reading this book, readers will be able to

Understand the role of rootkits in remote command/control and software eavesdropping Build kernel rootkits that can make processes, files, and directories invisible Master key rootkit programming techniques, including hooking, runtime patching, and directly manipulating kernel objects Work with layered drivers to implement keyboard sniffers and file filters Detect rootkits and build host-based intrusion prevention software that resists rootkit attacks

Author Notes

Greg Hoglund has been a pioneer in the area of software security. He is CEO of HBGary, Inc., a leading provider of software security verification services. After writing one of the first network vulnerability scanners (installed in over half of all Fortune 500 companies), he created and documented the first Windows NT-based rootkit, founding in the process. Greg is a frequent speaker at Black Hat, RSA, and other security conferences.

James Butler, Director of Engineering at HBGary, has a world-class talent for kernel programming and rootkit development and extensive experience in host-based intrusion-detection systems. He is the developer of VICE, a rootkit detection and forensics system. Jamie's previous positions include Senior Security Software Engineer at Enterasys and Computer Scientist at the National Security Agency. He is a frequent trainer and speaker at Black Hat security conferences. He holds a masters of computer science from the University of Maryland, Baltimore County. He has published articles in the IEEE Information Assurance Workshop, Phrack, USENIX ;login:, and Information Management and Computer Security.



A rootkit is a set of programs and code that allows a permanent and undetectable presence on a computer. Historical Background We became interested in rootkits because of our professional work in computer security, but the pursuit of the subject quickly expanded into a personal mission (also known as late nights and weekends). This led Hoglund to found, a forum devoted to reverse engineering and rootkit development. Both of us are deeply involved with Butler first contacted Hoglund online through this Web site because Butler had a new and powerful rootkit called FU that needed testing, 1 Butler sent Hoglund some source code and a pre-compiled binary. However, by accident, he did not send Hoglund the source code to the kernel driver. To Butler's amazement, Hoglund just loaded the pre-compiled rootkit onto his workstation without question, and reported back that FU seemed to be working fine! Our trust in one another has only grown since then. 2 Both of us have long been driven by an almost perverse need to reverse-engineer the Windows kernel. It's like when someone says we can't do something--then we accomplish it. It is very satisfying learning how so-called computer security products work and finding ways around them. This inevitably leads to better protection mechanisms. The fact that a product claims to provide some level of protection does not necessarily mean it actually does. By playing the part of an attacker, we are always at an advantage. As the attacker we must think of only one thing that a defender didn't consider. Defenders, on the other hand, must think of every possible thing an attacker might do. The numbers work in the attacker's favor. We teamed up a few years ago to offer the training class "Offensive Aspects of Rootkit Technology." This training started as a single day of material that since has grown to include hundreds of pages of notes and example code. The material for the class eventually became the foundation for this book. We now offer the rootkit training class several times a year at the Black Hat security conference, and also privately. After training for awhile, we decided to deepen our relationship, and we now work together at HBGary, Inc. At HBGary, we tackle very complex rootkit problems on a daily basis. In this book, we use our experience to cover the threats that face Windows users today, and likely will only increase in the future. Target Audience This book is intended for those who are interested in computer security and want a truer perspective concerning security threats. A lot has been written on how intruders gain access to computer systems, but little has been said regarding what can happen once an intruder gains that initial access. Like the title implies, this book will cover what an intruder can do to cover her presence on a compromised machine. We believe that most software vendors, including Microsoft, do not take rootkits seriously. That is why we are publishing this book. The material in this book is not groundbreaking for someone who has worked with rootkits or operating systems for years--but for most people this book should prove that rootkits are a serious threat. It should prove that your virus scanner or desktop firewall is never good enough. It should prove that a rootkit can get into your computer and stay there for years without you ever knowing about it. To best convey rootkit information, we wrote most of this book from an attacker's perspective; however, we end the book on a defensive posture. As you begin to learn your attackers' goals and techniques, you will begin to learn your own system's weaknesses and how to mitigate its shortcomings. Reading this book will help you improve the security of your system or help you make informed decisions when it comes to purchasing security software. Prerequisites As all of the code samples are written in C, you will gain more insight if you already understand basic C concepts--the most important one being pointers. If you have no programming knowledge, you should still be able to follow along and understand the threats without needing to understand the particular implementation details. Some areas of the book draw on principles from the Windows device driver architecture, but experience writing device drivers is not required. We will walk you through writing your first Windows device driver and build from there. Scope This book covers Windows rootkits, although most of the concepts apply to other operating systems as well, such as LINUX. We focus on kernel rootkits because these are the most difficult to detect. Many public rootkits for Windows are userland rootkits 3 because these are the easiest to implement, since they do not involve the added complexity of understanding how the undocumented kernel works. This book is not about specific real-world rootkits. Rather, it teaches the generic approaches used by all rootkits. In each chapter, we introduce a basic technique, explain its purposes, and show how it's implemented using code examples. Armed with this information, you should be able to expand the examples in a million different ways to perform a variety of tasks. When working in the kernel, you are really limited only by your imagination. You can download most of the code in this book from . Throughout the book, we will reference the particular URL for each individual example. Other rootkit authors also publish research at that you may find useful for keeping up with the latest discoveries. 1. Butler was not interested in rootkits for malicious purposes. He was instead fascinated with the power of kernel modifications. This led Butler to develop one of the first rootkit-detection programs, VICE. 2. Hoglund still wonders, from time to time, whether that original version of FU is still running on his workstation. 3. Userland rootkits are rootkits that do not employ kernel-level modifications, but instead rely only upon user-program modifications. 0321294319P07072005 Excerpted from Rootkits: Subverting the Windows Kernel by Greg Hoglund, Jamie Butler All rights reserved by the original copyright owners. Excerpts are provided for display purposes only and may not be reproduced, reprinted or distributed without the written permission of the publisher.

Table of Contents

Prefacep. xv
Acknowledgmentsp. xix
About the Authorsp. xxi
About the Coverp. xxiii
1 Leave No Tracep. 1
Understanding Attackers' Motivesp. 2
The Role of Stealthp. 2
When Stealth Doesn't Matterp. 3
What Is a Rootkit?p. 4
Why Do Rootkits Exist?p. 4
Remote Command and Controlp. 5
Software Eavesdroppingp. 5
Legitimate Uses of Rootkitsp. 6
How Long Have Rootkits Been Around?p. 7
How Do Rootkits Work?p. 8
Patchingp. 8
Easter Eggsp. 9
Spyware Modificationsp. 9
Source-Code Modificationp. 9
The Legality of Software Modificationp. 10
What a Rootkit Is Notp. 10
A Rootkit Is Not an Exploitp. 11
A Rootkit Is Not a Virusp. 11
Rootkits and Software Exploitsp. 13
Why Exploits Are Still a Problemp. 15
Offensive Rootkit Technologiesp. 17
HIPSp. 17
NIDSp. 17
Bypassing the IDS/IPSp. 18
Bypassing Forensic Toolsp. 18
Conclusionp. 20
2 Subverting the Kernelp. 21
Important Kernel Componentsp. 22
Rootkit Designp. 23
Introducing Code into the Kernelp. 25
Building the Windows Device Driverp. 26
The Device Driver Development Kitp. 27
The Build Environmentsp. 27
The Filesp. 27
Running the Build Utilityp. 29
The Unload Routinep. 30
Loading and Unloading the Driverp. 30
Logging the Debug Statementsp. 31
Fusion Rootkits: Bridging User and Kernel Modesp. 32
I/O Request Packetsp. 33
Creating a File Handlep. 37
Adding a Symbolic Linkp. 38
Loading the Rootkitp. 39
The Quick-and-Dirty Way to Load a Driverp. 40
The Right Way to Load a Driverp. 41
Decompressing the .sys File from a Resourcep. 43
Surviving Rebootp. 46
Conclusionp. 47
3 The Hardware Connectionp. 49
Ring Zerop. 50
Tables, Tables, and More Tablesp. 52
Memory Pagesp. 53
Memory Access Check Detailsp. 53
Paging and Address Translationp. 55
Page-Table Lookupsp. 56
The Page-Directory Entryp. 58
The Page-Table Entryp. 59
Read-Only Access to Some Important Tablesp. 59
Multiple Processes, Multiple Page Directoriesp. 59
Processes and Threadsp. 60
The Memory Descriptor Tablesp. 61
The Global Descriptor Tablep. 61
The Local Descriptor Tablep. 62
Code Segmentsp. 62
Call Gatesp. 62
The Interrupt Descriptor Tablep. 62
Other Types of Gatesp. 65
The System Service Dispatch Tablep. 66
The Control Registersp. 66
Control Register Zero (CR0)p. 66
Other Control Registersp. 67
The EFlags Registerp. 67
Multiprocessor Systemsp. 68
Conclusionp. 69
4 The Age-Old Art of Hookingp. 71
Userland Hooksp. 71
Import Address Table Hookingp. 73
Inline Function Hookingp. 74
Injecting a DLL into Userland Processesp. 76
Kernel Hooksp. 81
Hooking the System Service Descriptor Tablep. 82
Hooking the Interrupt Descriptor Tablep. 91
Hooking the Major I/O Request Packet Function Table in the Device Driver Objectp. 96
A Hybrid Hooking Approachp. 106
Getting into a Process' Address Spacep. 106
Memory Space for Hooksp. 111
Conclusionp. 112
5 Runtime Patchingp. 113
Detour Patchingp. 114
Rerouting the Control Flow Using MigBotp. 115
Checking for Function Bytesp. 117
Keeping Track of the Overwritten Instructionsp. 118
Using NonPagedPool Memoryp. 121
Runtime Address Fixupsp. 121
Jump Templatesp. 125
The Interrupt Hook Examplep. 126
Variations on the Methodp. 133
Conclusionp. 133
6 Layered Driversp. 135
A Keyboard Snifferp. 136
I/O Request Packet (IRP) and Stack Locationsp. 137
The KLOG Rootkit: A Walk-throughp. 140
File Filter Driversp. 153
Conclusionp. 167
7 Direct Kernel Object Manipulationp. 169
DKOM Benefits and Drawbacksp. 169
Determining the Version of the Operating Systemp. 171
User-Mode Self-Determinationp. 171
Kernel-Mode Self-Determinationp. 173
Querying the Operating System Version in the Registryp. 174
Communicating with the Device Driver from Userlandp. 175
Hiding with DKOMp. 179
Process Hidingp. 180
Device-Driver Hidingp. 185
Synchronization Issuesp. 189
Token Privilege and Group Elevation with DKOMp. 193
Modifying a Process Tokenp. 194
Faking out the Windows Event Viewerp. 208
Conclusionp. 210
8 Hardware Manipulationp. 213
Why Hardware?p. 215
Modifying the Firmwarep. 216
Accessing the Hardwarep. 217
Hardware Addressesp. 217
Accessing Hardware Is Not Like Accessing RAMp. 218
Timing Considerationsp. 219
The I/O Busp. 219
Accessing the BIOSp. 221
Accessing PCI and PCMCIA Devicesp. 221
Example: Accessing the Keyboard Controllerp. 222
The 8259 Keyboard Controllerp. 222
Changing the LED Indicatorsp. 222
Hard Rebootp. 229
Keystroke Monitorp. 229
How Low Can You Go? Microcode Updatep. 236
Conclusionp. 237
9 Covert Channelsp. 239
Remote Command, Control, and Exfiltration of Datap. 240
Disguised TCP/IP Protocolsp. 241
Beware of Traffic Patternsp. 242
Don't Send Data "in the Clear"p. 242
Use Time to Your Advantagep. 243
Hide Under DNS Requestsp. 243
"Stego" on ASCII Payloadsp. 244
Use Other TCP/IP Channelsp. 245
Kernel TCP/IP Support for Your Rootkit Using TDIp. 246
Build the Address Structurep. 246
Create a Local Address Objectp. 248
Create a TDI Endpoint with Contextp. 252
Associate an Endpoint with a Local Addressp. 254
Connect to a Remote Server (Send the TCP Handshake)p. 257
Send Data to a Remote Serverp. 259
Raw Network Manipulationp. 262
Implementing Raw Sockets on Windows XPp. 262
Binding to an Interfacep. 263
Sniffing with Raw Socketsp. 264
Promiscuous Sniffing with Raw Socketsp. 264
Sending Packets with Raw Socketsp. 265
Forging the Sourcep. 266
Bouncing Packetsp. 266
Kernel TCP/IP Support for Your Rootkit Using NDISp. 267
Registering the Protocolp. 267
The Protocol Driver Callbacksp. 273
Moving Whole Packetsp. 278
Host Emulationp. 285
Creating Your MAC Addressp. 286
Handling ARPp. 286
The IP Gatewayp. 289
Sending a Packetp. 289
Conclusionp. 293
10 Rootkit Detectionp. 295
Detecting Presencep. 295
Guarding the Doorsp. 296
Scanning the "Rooms"p. 298
Looking for Hooksp. 298
Detecting Behaviorp. 308
Detecting Hidden Files and Registry Keysp. 308
Detecting Hidden Processesp. 309
Conclusionp. 312
Indexp. 315