Designing BSD Rootkits : An Introduction to Kernel Hacking - Joseph Kong

Instant online reading.
Don't wait for delivery!
Go digital and save!

Designing BSD Rootkits

An Introduction to Kernel Hacking

By: Joseph Kong

Write A Review

1 April 2007

At a Glance

No. of Pages
144

Dimensions(cm)
23.5 x 17.78 x 1.27

$85.75

or 4 interest-free payments of $21.44 with

or

Ships in 5 to 10 business days

Though rootkits have a fairly negative image, they can be used for both good and evil. Designing BSD Rootkits arms you with the knowledge you need to write offensive rootkits, to defend against malicious ones, and to explore the FreeBSD kernel and operating system in the process.

Organized as a tutorial, Designing BSD Rootkits will teach you the fundamentals of programming and developing rootkits under the FreeBSD operating system. Author Joseph Kong's goal is to make you smarter, not to teach you how to write exploits or launch attacks. You'll learn how to maintain root access long after gaining access to a computer and how to hack FreeBSD.

Kongs liberal use of examples assumes no prior kernel-hacking experience but doesn't water down the information. All code is thoroughly described and analyzed, and each chapter contains at least one real-world application. Inside the book, you'll find examples of:

The fundamentals of FreeBSD kernel module programming
Using call hooking to subvert the FreeBSD kernel
Directly manipulating the objects the kernel depends upon for its internal record-keeping
Patching kernel code resident in main memory; in other words, altering the kernel's logic while it's still running
How to defend against the attacks described

Hack the FreeBSD kernel for yourself!

Shipping

	Standard Shipping	Express Shipping
Metro postcodes:	$9.99	$14.95
Regional postcodes:	$9.99	$14.95
Rural postcodes:	$9.99	$14.95

Orders over $0.00 qualify for free shipping.

How to return your order

At Booktopia, we offer hassle-free returns in accordance with our returns policy. If you wish to return an item, please get in touch with Booktopia Customer Care.

Additional postage charges may be applicable.

Defective items

If there is a problem with any of the items received for your order then the Booktopia Customer Care team is ready to assist you.

For more info please visit our Help Centre.

More in Programming & Scripting Languages

Computer Science Why

Answers to Computer Science Questions They Donât Cover in Class

Paperback

RRP $110.00

$96.75

12%
OFF

Computer Science Why

Answers to Computer Science Questions They Donât Cover in Class

Hardcover

RRP $326.00

$280.99

14%
OFF

Beginner's Step-by-Step Coding Course

Learn Computer Programming the Easy Way

Hardcover

RRP $45.00

$35.75

21%
OFF

Python Crash Course

3rd Edition - A Hands-On, Project-Based Introduction to Programming

Paperback

RRP $89.99

$64.99

28%
OFF

Teasers : Exercise Your Mind - Rebecca Skinner

$73.75

51%
OFF

Python All-in-One For Dummies

3rd Edition

Paperback

RRP $74.95

$52.47

30%
OFF

The C Programming Language

Prentice Hall Software

Paperback

RRP $107.04

$75.75

29%
OFF

Introduction to Programming Languages - Gordon Hurley

$47.75

49%
OFF

C# 12 in a Nutshell

The Definitive Reference

Paperback

RRP $133.00

$64.75

51%
OFF

Statistical Analysis with R For Dummies

For Dummies (Computer/Tech)

Paperback

RRP $49.95

$34.97

30%
OFF

The Pragmatic Programmer 2nd edition

your journey to mastery, 20th Anniversary Edition

Hardcover

RRP $91.30

$65.75

28%
OFF

Automate the Boring Stuff with Python, 3rd Edition

Paperback

RRP $84.99

$61.99

27%
OFF

Flask Web Development, 2nd Edition

Developing Web Applications with Python

Paperback

RRP $106.75

$52.75

51%
OFF

Python for Data Analysis

Data Wrangling with Pandas, Numpy, and Jupyter

Paperback

RRP $152.00

$73.75

51%
OFF

C++ How to Program, Global Edition

10th Edition

Paperback

RRP $167.95

$133.75

20%
OFF

C++ How to Program, Global Edition : 11th Edition - Harvey Deitel & Associates

$81.75

38%
OFF

Java

An Introduction to Problem Solving and Programming, 8th Global Edition

Paperback

RRP $141.69

$105.75

25%
OFF

Problem Solving and Program Design in C, Global Edition

8th Edition

Paperback

RRP $174.02

$133.75

23%
OFF

Foreword	p. xiii
Introduction	p. xv
What Is a Rootkit?	p. xvi
Why FreeBSD?	p. xvi
The Goals of This Book	p. xvi
Who Should Read This Book?	p. xvi
Contents Overview	p. xvi
Conventions Used in This Book	p. xvii
Concluding Remarks	p. xvii
Loadable Kernel Modules	p. 1
Module Event Handler	p. 2
The DECLARE_MODULE Macro	p. 3
"Hello, world!"	p. 4
System Call Modules	p. 6
The System Call Function	p. 6
The sysent Structure	p. 7
The Offset Value	p. 8
The SYSCALL_MODULE Macro	p. 8
Example	p. 9
The modfind Function	p. 10
The modstat Function	p. 10
The syscall Function	p. 11
Executing the System Call	p. 11
Executing the System Call Without C Code	p. 12
Kernel/User Space Transitions	p. 12
The copyin and copyinstr Functions	p. 13
The copyout Function	p. 13
The copystr Function	p. 13
Character Device Modules	p. 14
The cdevsw Structure	p. 14
Character Device Functions	p. 15
The Device Registration Routine	p. 16
Example	p. 17
Testing the Character Device	p. 19
Linker Files and Modules	p. 21
Concluding Remarks	p. 22
Hooking	p. 23
Hooking a System Call	p. 24
Keystroke Logging	p. 26
Kernel Process Tracing	p. 28
Common System Call Hooks	p. 29
Communication Protocols	p. 30
The protosw Structure	p. 30
The inetsw Switch Table	p. 31
The mbuf Structure	p. 32
Hooking a Communication Protocol	p. 32
Concluding Remarks	p. 33
Direct Kernel Object Manipulation	p. 37
Kernel Queue Data Structures	p. 37
The LIST_HEAD Macro	p. 38
The LIST_HEAD_INITIALIZER Macro	p. 38
The LIST_ENTRY Macro	p. 38
The LlST_FOREACH Macro	p. 39
The LIST_REMOVE Macro	p. 39
Synchronization Issues	p. 39
The mtx_lock Function	p. 40
The mtx_unlock Function	p. 40
The sx_slock and sx_xlock Functions	p. 40
The sx_sunlock and sx_xunlock Functions	p. 41
Hiding a Running Process	p. 41
The proc Structure	p. 41
The allproc List	p. 42
Example	p. 43
Hiding a Running Process Redux	p. 46
The hashinit Function	p. 47
pidhashtbl	p. 47
The pfind Function	p. 48
Example	p. 48
Hiding with DKOM	p. 51
Hiding an Open TCP-based Port	p. 52
The inpcb Structure	p. 52
The tcbinfo.listhead List	p. 53
Example	p. 54
Corrupting Kernel Data	p. 56
Concluding Remarks	p. 57
Kernel Object Hooking	p. 59
Hooking a Character Device	p. 59
The cdevp_list and cdev_priv Structures	p. 60
The devmtx Mutex	p. 60
Example	p. 60
Concluding Remarks	p. 62
Run-Time Kernel Memory Patching	p. 63
Kernel Data Access Library	p. 63
The kvm_openfiles Function	p. 64
The kvm_nlist Function	p. 64
The kvm_geterr Function	p. 65
The kvm_read Function	p. 65
The kvm_write Function	p. 65
The kvm_close Function	p. 66
Patching Code Bytes	p. 66
Understanding x86 Call Statements	p. 70
Patching Call Statements	p. 70
Allocating Kernel Memory	p. 73
The malloc Function	p. 73
The MALLOC Macro	p. 74
The free Function	p. 74
The FREE Macro	p. 74
Example	p. 75
Allocating Kernel Memory from User Space	p. 77
Example	p. 77
Inline Function Hooking	p. 81
Example	p. 82
Gotchas	p. 88
Cloaking System Call Hooks	p. 88
Concluding Remarks	p. 90
Putting It All Together	p. 91
What HIDSes Do	p. 91
Bypassing HIDSes	p. 92
Execution Redirection	p. 92
File Hiding	p. 96
Hiding a KLD	p. 101
The linker_files List	p. 102
The linker_file Structure	p. 102
The modules List	p. 103
The module Structure	p. 103
Example	p. 104
Preventing Access, Modification, and Change Time Updates	p. 107
Change Time	p. 108
Example	p. 112
Proof of Concept: Faking Out Tripwire	p. 114
Concluding Remarks	p. 117
Detection	p. 119
Detecting Call Hooks	p. 120
Finding System Call Hooks	p. 120
Defecting DKOM	p. 123
Finding Hidden Processes	p. 123
Finding Hidden Ports	p. 125
Defecting Run-Time Kernel Memory Patching	p. 125
Finding Inline Function Hooks	p. 125
Finding Code Byte Patches	p. 125
Concluding Remarks	p. 126
Closing Words	p. 127
Bibliography	p. 129
Index	p. 131
Table of Contents provided by Ingram. All Rights Reserved.

Designing BSD Rootkits

An Introduction to Kernel Hacking

At a Glance

Shipping

How to return your order

Defective items

You Can Find This Book In

More in Programming & Scripting Languages

Computer Science Why

Answers to Computer Science Questions They Donât Cover in Class

Computer Science Why

Answers to Computer Science Questions They Donât Cover in Class

Beginner's Step-by-Step Coding Course

Learn Computer Programming the Easy Way

Python Crash Course

3rd Edition - A Hands-On, Project-Based Introduction to Programming

Teasers

Exercise Your Mind

Fluent Python

Clear, Concise, and Effective Programming 2nd Edition

Python All-in-One For Dummies

3rd Edition

The C Programming Language

Prentice Hall Software

Introduction to Programming Languages

Python Programming with Generative AI

Python Programming Advanced

Swift

The Practical Guide

Think Python

How To Think Like a Computer Scientist

C# 12 in a Nutshell

The Definitive Reference

Statistical Analysis with R For Dummies

For Dummies (Computer/Tech)

The Pragmatic Programmer 2nd edition

your journey to mastery, 20th Anniversary Edition

Automate the Boring Stuff with Python, 3rd Edition

Flask Web Development, 2nd Edition

Developing Web Applications with Python

Python for Data Analysis

Data Wrangling with Pandas, Numpy, and Jupyter

C++ How to Program, Global Edition

10th Edition

C++ How to Program, Global Edition

11th Edition

Algorithms in C, Parts 1-4

3rd Edition - Fundamentals, Data Structures, Sorting, Searching

Java

An Introduction to Problem Solving and Programming, 8th Global Edition

Problem Solving and Program Design in C, Global Edition

8th Edition

This product is categorised by