Professional Rootkits (Paperback)

Ric Vieler

  • 出版商: Wrox Press
  • 出版日期: 2007-03-12
  • 定價: $1,650
  • 售價: 6.0$990
  • 語言: 英文
  • 頁數: 360
  • 裝訂: Paperback
  • ISBN: 0470101547
  • ISBN-13: 9780470101544
  • 相關分類: 資訊安全軟體測試
  • 立即出貨 (庫存 < 4)

買這商品的人也買了...

商品描述

Description

 
Whether you want to learn how to develop a robust, full-featured rootkit or you're looking for effective ways to prevent one from being installed on your network, this hands-on resource provides you with the tools you'll need. Expert developer Ric Vieler walks you through all of the capabilities of rootkits, the technology they use, steps for developing and testing them, and the detection methods to impede their distribution.

This book provides the detailed, step-by-step instructions and examples required to produce full-featured, robust rootkits. Presented in modular sections, source code from each chapter can be used separately or together to produce highlyspecific functionality. In addition, Vieler details the loading, configuration, and control techniques used to deploy rootkits. All ancillary software is fully detailed with supporting source code and links to the compilers, utilities, and scripts necessary to build and run every example provided.

What you will learn from this book

* Complete coverage of all major rootkit technologies: kernel hooks, process injection, I/O filtering, I/O control, memory management, process synchronization, TDI communication, network filtering, email filtering, key logging, process hiding, device driver hiding, registry key hiding, directory hiding and more
*

Complete coverage of the compilers, kits, utilities, and tools required to develop robust rootkits
*

Techniques for protecting your system by detecting a rootkit before it's installed
*

Ways to create modular, commercial grade software

Who this book is for

This book is for anyone who is involved in software development or computer security.

Wrox Professional guides are planned and written by working programmers to meet the real-world needs of programmers, developers, and IT professionals. Focused and relevant, they address the issues technology professionals face every day. They provide examples, practical solutions, and expert education in new technologies, all designed to help programmers do a better job.
 

Table of Contents

Introduction.

Chapter 1: Tools.

How Do I Build a Rootkit?

The Microsoft Driver Development Kit.

Microsoft Visual VC++ 2005 Express.

Microsoft Software Developers Kit.

Sysinternals Freeware.

IDA.

Debugging Tools for Windows.

Verification.

VCVARS32.BAT.

Other Tools to Consider.

What to Keep Out.

Summary.

Chapter 2: A Basic Rootkit.

Ghost.

Alternate Data Streams.

Installing Your Rootkit.

Testing Your Rootkit.

Summary.

Chapter 3: Kernel Hooks.

The System Call Table.

Kernel Memory Protection.

Defining a Hook Function.

An Example.

hookManager.c.

hookManager.h.

What to Hook?

Csr — Client Server Run Time.

Dbg — Debug Manager.

Etw — Event Tracing for Windows.

Ki — Kernel (must be called from Kernel).

Ldr — Loader Manager.

Pfx — ANSI Prefix Manager.

Rtl — Runtime Library.

Zw — File and Registry.

The Problem with Hooking.

Summary.

Chapter 4: User Hooks.

Process Injection.

Finding a Specific Dynamic Link Library.

Defining a Hook Function.

The Trampoline Function.

An Example.

Ghost.h.

Ghost.c.

hookManager.h.

hookManager.c.

injectManager.h.

injectManager.c.

parse86.h.

parse86.c.

peFormat.h.

Using Ghost to Block PGP Encoding.

Summary.

Chapter 5: I/O Processing.

Using DeviceIoControl.

The Console Application.

Controller.c.

IoManager.h.

buildController.bat.

Handling IO within the Device Driver.

IoManager.c.

Injected Function Programming.

Testing I/O Control.

Summary.

Chapter 6: Communications.

The Transport Driver Interface.

Initiating the Connection.

An Example.

commManager.h.

commManager.c.

Running the Example.

Summary.

Chapter 7: Filter Drivers.

Inserting a Filter Driver.

File Filtering.

Network Filtering.

Combined Filtering.

An Example.

filterManager.h.

filterManager.c.

Ghost.c.

IoManager.h.

IoManager.c.

Summary.

Chapter 8: Key Logging.

Processing Levels.

A Keyboard Filter.

Threading and Synchronization.

Interpreting Key Codes.

An Example.

SOURCES.

Ghost.c.

filterManager.c.

filterManager.h.

IoManager.c.

keyManager.h.

keyManager.c.

OnKeyboardRead.

OnReadCompletion.

GetKey.

InitializeLogThread.

KeyLoggerThread.

StartKeylogger.

StopKeylogger.

OnCancel.

Testing the Example.

Summary.

Chapter 9: Concealment.

Registry Key Hiding.

registryManager.h.

registryManager.c.

Ghost.c.

hookManager.h.

hookManager.c.

Directory Hiding.

Process Hiding.

HideMe.c.

Testing Concealment.

Summary.

Chapter 10: E-mail Filtering.

Microsoft Outlook E-mail Filtering.

OutlookExtension.h.

OutlookExtension.cpp.

Installing an Outlook Client Filter.

Testing the Outlook Client Extension.

Lotus Notes E-mail Filtering.

LotusExtension.h.

LotusExtension.c.

LotusExtension.def.

LotusExtension.mak.

readme.txt.

Installing a Lotus Notes Client Filter.

Testing the Lotus Notes Client Extension.

Summary.

Chapter 11: Installation Considerations.

Intended Installation.

Intended Installation Software.

End User License Agreements (EULAs).

Unintended Installation.

Privilege Escalation.

Persistence.

ZwSetSystemInformation with SystemLoadAndCallImage.

Registry Possibilities.

Initialization Files.

Installing onto Machines That Visit Your Website.

Removing the Traces of an Installation.

Testing Your Installation Techniques.

Summary.

Chapter 12: Ghost Tracker.

The Controller.

The Connection.

Tamper Detection.

An Example.

GhostTracker.cs.

ControlForm.cs.

TargetController.cs.

Listen.cs.

GhostTracker.

ControlForm.

Summary.

Chapter 13: Detecting Rootkits.

Detection Methods.

Detection Software.

What to Do with a Detected Rootkit.

Safe Mode.

Summary.

Chapter 14: Preventing Rootkits.

Operating System Updates.

Automatic Updates.

Personal Firewalls.

Free Personal Firewalls.

Other Personal Firewalls.

Host-based Intrusion Prevention Systems.

Hardening.

Virtualizing.

Blocking Unexpected Operations.

Rootkit Prevention Techniques.

Summary.

Appendix A: Freeware.

Index.

商品描述(中文翻譯)

描述

無論您想學習如何開發強大、功能完整的 rootkit,或者您正在尋找有效的方法來防止 rootkit 安裝在您的網絡上,這本實用資源將為您提供所需的工具。專業開發人員 Ric Vieler 將引導您了解 rootkit 的所有功能、它們使用的技術、開發和測試它們的步驟,以及阻止它們分發的檢測方法。

本書提供了詳細的、逐步的說明和示例,以製作功能完整、強大的 rootkit。每個章節的源代碼可以單獨使用或結合在一起,以產生高度特定的功能。此外,Vieler 還詳細介紹了部署 rootkit 所使用的加載、配置和控制技術。所有附屬軟體都有詳細的支援源代碼和連結,以編譯器、工具和腳本來構建和運行提供的每個示例。

本書的學習重點:

- 所有主要 rootkit 技術的全面覆蓋:內核鉤子、進程注入、I/O 過濾、I/O 控制、內存管理、進程同步、TDI 通信、網絡過濾、電子郵件過濾、鍵盤記錄、進程隱藏、設備驅動程序隱藏、註冊表鍵隱藏、目錄隱藏等等
- 開發強大 rootkit 所需的編譯器、工具和套件的全面覆蓋
- 在安裝 rootkit 之前檢測 rootkit 的技術
- 創建模塊化、商業級軟體的方法

本書適合對軟體開發或電腦安全有興趣的任何人。

Wrox 專業指南由實踐中的程式設計師計劃和撰寫,以滿足程式設計師、開發人員和 IT 專業人員的實際需求。這些指南聚焦且相關,解決技術專業人員每天面臨的問題。它們提供實例、實用解決方案和專家教育,涵蓋新技術,旨在幫助程式設計師做得更好。

目錄

介紹

第一章:工具

如何構建 rootkit

Microsoft 驅動程式開發套件

Microsoft Visual VC++ 2005 Express

Microsoft 軟體開發套件

Sysinternals 免費軟體

IDA

Windows 調試工具

驗證

VCVARS32.BAT

其他工具