Summer Reading B2G1 Free

Special Offers see all

Enter to WIN a $100 Credit

Subscribe to
for a chance to win.
Privacy Policy

Visit our stores

    Recently Viewed clear list

    Original Essays | July 15, 2015

    Frank Wilczek: IMG You Are... Who?

    Writing a book is an unnatural act of communication. Speaking to a person, or even to an audience, is an interaction. Very different styles are... Continue »
    1. $20.97 Sale Hardcover add to wish list

Qualifying orders ship free.
New Trade Paper
Ships in 1 to 3 days
Add to Wishlist
available for shipping or prepaid pickup only
Available for In-store Pickup
in 7 to 12 days
Qty Store Section
1 Remote Warehouse Internet- General

This title in other editions

Rootkits: Subverting the Windows Kernel


Rootkits: Subverting the Windows Kernel Cover


Synopses & Reviews

Publisher Comments:

"It's imperative that everybody working in the field of cyber-security read this book to understand the growing threat of rootkits."

--Mark Russinovich, editor, Windows IT Pro / Windows & .NET Magazine

"This material is not only up-to-date, it defines up-to-date. It is truly cutting-edge. As the only book on the subject, Rootkits will be of interest to any Windows security researcher or security programmer. It's detailed, well researched and the technical information is excellent. The level of technical detail, research, and time invested in developing relevant examples is impressive. In one word: Outstanding."

--Tony Bautts, Security Consultant; CEO, Xtivix, Inc.

"This book is an essential read for anyone responsible for Windows security. Security professionals, Windows system administrators, and programmers in general will want to understand the techniques used by rootkit authors. At a time when many IT and security professionals are still worrying about the latest e-mail virus or how to get all of this month's security patches installed, Mr. Hoglund and Mr. Butler open your eyes to some of the most stealthy and significant threats to the Windows operating system. Only by understanding these offensive techniques can you properly defend the networks and systems for which you are responsible."

--Jennifer Kolde, Security Consultant, Author, and Instructor

"What's worse than being owned? Not knowing it. Find out what it means to be owned by reading Hoglund and Butler's first-of-a-kind book on rootkits. At the apex the malicious hacker toolset--which includes decompilers, disassemblers, fault-injection engines, kernel debuggers, payload collections, coverage tools, and flow analysis tools--is the rootkit. Beginning where Exploiting Software left off, this book shows how attackers hide in plain sight.

"Rootkits are extremely powerful and are the next wave of attack technology. Like other types of malicious code, rootkits thrive on stealthiness. They hide away from standard system observers, employing hooks, trampolines, and patches to get their work done. Sophisticated rootkits run in such a way that other programs that usually monitor machine behavior can't easily detect them. A rootkit thus provides insider access only to people who know that it is running and available to accept commands. Kernel rootkits can hide files and running processes to provide a backdoor into the target machine.

"Understanding the ultimate attacker's tool provides an important motivator for those of us trying to defend systems. No authors are better suited to give you a detailed hands-on understanding of rootkits than Hoglund and Butler. Better to own this book than to be owned."

--Gary McGraw, Ph.D., CTO, Cigital, coauthor of Exploiting Software (2004) and Building Secure Software (2002), both from Addison-Wesley

"Greg and Jamie are unquestionably the go-to experts when it comes to subverting the Windows API and creating rootkits. These two masters come together to pierce the veil of mystery surrounding rootkits, bringing this information out of the shadows. Anyone even remotely interested in security for Windows systems, including forensic analysis, should include this book very high on their must-read list."

--Harlan Carvey, author of Windows Forensics and Incident Recovery (Addison-Wesley, 2005)

Rootkits are the ultimate backdoor, giving hackers ongoing and virtually undetectable access to the systems they exploit. Now, two of the world's leading experts have written the first comprehensive guide to rootkits: what they are, how they work, how to build them, and how to detect them.'s Greg Hoglund and James Butler created and teach Black Hat's legendary course in rootkits. In this book, they reveal never-before-told offensive aspects of rootkit technology--learn how attackers can get in and stay in for years, without detection.

Hoglund and Butler show exactly how to subvert the Windows XP and Windows 2000 kernels, teaching concepts that are easily applied to virtually any modern operating system, from Windows Server 2003 to Linux and UNIX. They teach rootkit programming techniques that can be used for a wide range of software, from white hat security tools to operating system drivers and debuggers.

After reading this book, readers will be able to

  • Understand the role of rootkits in remote command/control and software eavesdropping
  • Build kernel rootkits that can make processes, files, and directories invisible
  • Master key rootkit programming techniques, including hooking, runtime patching, and directly manipulating kernel objects
  • Work with layered drivers to implement keyboard sniffers and file filters
  • Detect rootkits and build host-based intrusion prevention software that resists rootkit attacks

About the Author

Greg Hoglund has been a pioneer in the area of software security. He is CEO of HBGary, Inc., a leading provider of software security verification services. After writing one of the first network vulnerability scanners (installed in over half of all Fortune 500 companies), he created and documented the first Windows NT-based rootkit, founding in the process. Greg is a frequent speaker at Black Hat, RSA, and other security conferences.

James Butler, Director of Engineering at HBGary, has a world-class talent for kernel programming and rootkit development and extensive experience in host-based intrusion-detection systems. He is the developer of VICE, a rootkit detection and forensics system. Jamie's previous positions include Senior Security Software Engineer at Enterasys and Computer Scientist at the National Security Agency. He is a frequent trainer and speaker at Black Hat security conferences. He holds a masters of computer science from the University of Maryland, Baltimore County. He has published articles in the IEEE Information Assurance Workshop, Phrack, USENIX ;login:, and Information Management and Computer Security.

Table of Contents



About the Authors.

About the Cover.

1. Leave No Trace.

    Understanding Attackers’ Motives.

    What Is a Rootkit?

    Why Do Rootkits Exist?

    How Long Have Rootkits Been Around?

    How Do Rootkits Work?

    What a Rootkit Is Not.

    Rootkits and Software Exploits.

    Offensive Rootkit Technologies.


2. Subverting the Kernel.

    Important Kernel Components.

    Rootkit Design.

    Introducing Code into the Kernel.

    Building the Windows Device Driver.

    Loading and Unloading the Driver.

    Logging the Debug Statements.

    Fusion Rootkits: Bridging User and Kernel Modes.

    Loading the Rootkit.

    Decompressing the .sys File from a Resource.

    Surviving Reboot.


3. The Hardware Connection.

    Ring Zero.

    Tables, Tables, and More Tables.

    Memory Pages.

    The Memory Descriptor Tables.

    The Interrupt Descriptor Table.

    The System Service Dispatch Table.

    The Control Registers.

    Multiprocessor Systems.


4. The Age-Old Art of Hooking.

    Userland Hooks.

    Kernel Hooks.

    A Hybrid Hooking Approach.


5. Runtime Patching.

    Detour Patching.

    Jump Templates.

    Variations on the Method.


6. Layered Drivers.

    A Keyboard Sniffer.

    The KLOG Rootkit: A Walk-through.

    File Filter Drivers.


7. Direct Kernel Object Manipulation.

    DKOM Benefits and Drawbacks.

    Determining the Version of the Operating System.

    Communicating with the Device Driver from Userland.

    Hiding with DKOM.

    Token Privilege and Group Elevation with DKOM.


8. Hardware Manipulation.

    Why Hardware?

    Modifying the Firmware.

    Accessing the Hardware.

    Example: Accessing the Keyboard Controller.

    How Low Can You Go? Microcode Update.


9. Covert Channels.

    Remote Command, Control, and Exfiltration of Data.

    Disguised TCP/IP Protocols.

    Kernel TCP/IP Support for Your Rootkit Using TDI.

    Raw Network Manipulation.

    Kernel TCP/IP Support for Your Rootkit Using NDIS.

    Host Emulation.


10. Rootkit Detection.

    Detecting Presence.

    Detecting Behavior.




Product Details

Hoglund, Greg
Addison-Wesley Professional
lund, Greg
Butler, Jamie
Computer security
Internet - Security
Computers -- Access control.
Internet - General
Edition Description:
Trade paper
Addison-Wesley Software Security Series
Publication Date:
July 2005
Grade Level:
Professional and scholarly
9 x 7 x 1 in 680 gr

Other books you might like

  1. Novell GroupWise 6.5 Administrator's... New Trade Paper $58.50
  2. Cisco Security Bible (Bible) New Trade Paper $80.00
  3. Trusted Computing Platforms: Design... New Hardcover $194.25
  4. Vanishing Women: Magic, Film, and... New Trade Paper $25.25
  5. Interrupted Life: The Diaries of... Used Mass Market $4.50

Related Subjects

» Computers and Internet » Internet » General
» Computers and Internet » Internet » Information
» Computers and Internet » Networking » Computer Security

Rootkits: Subverting the Windows Kernel New Trade Paper
0 stars - 0 reviews
$58.50 In Stock
Product details 352 pages Addison-Wesley Professional - English 9780321294319 Reviews:
  • back to top


Powell's City of Books is an independent bookstore in Portland, Oregon, that fills a whole city block with more than a million new, used, and out of print books. Shop those shelves — plus literally millions more books, DVDs, and gifts — here at