Designing Bsd Rootkits : No Starch Press Ser. - Joseph Kong

Instant online reading.
Don't wait for delivery!
Go digital and save!

Designing Bsd Rootkits

By: Joseph Kong

Write A Review

Paperback | 1 April 2007

At a Glance

Paperback
144 Pages

Dimensions(cm)
23.5 x 17.78 x 1.27

Paperback

$90.75

or 4 interest-free payments of $22.69 with

Ships in 10 to 15 business days

Though rootkits have a fairly negative image, they can be used for both good and evil. Designing BSD Rootkits arms you with the knowledge you need to write offensive rootkits, to defend against malicious ones, and to explore the FreeBSD kernel and operating system in the process.

Organized as a tutorial, Designing BSD Rootkits will teach you the fundamentals of programming and developing rootkits under the FreeBSD operating system. Author Joseph Kong's goal is to make you smarter, not to teach you how to write exploits or launch attacks. You'll learn how to maintain root access long after gaining access to a computer and how to hack FreeBSD.

Kongs liberal use of examples assumes no prior kernel-hacking experience but doesn't water down the information. All code is thoroughly described and analyzed, and each chapter contains at least one real-world application. Inside the book, you'll find examples of:

The fundamentals of FreeBSD kernel module programming
Using call hooking to subvert the FreeBSD kernel
Directly manipulating the objects the kernel depends upon for its internal record-keeping
Patching kernel code resident in main memory; in other words, altering the kernel's logic while it's still running
How to defend against the attacks described

Hack the FreeBSD kernel for yourself!

Shipping

	Standard Shipping	Express Shipping
Metro postcodes:	$9.99	$14.95
Regional postcodes:	$9.99	$14.95
Rural postcodes:	$9.99	$14.95

Orders over $79.00 qualify for free shipping.

How to return your order

At Booktopia, we offer hassle-free returns in accordance with our returns policy. If you wish to return an item, please get in touch with Booktopia Customer Care.

Additional postage charges may be applicable.

Defective items

If there is a problem with any of the items received for your order then the Booktopia Customer Care team is ready to assist you.

For more info please visit our Help Centre.

You Can Find This Book In

Non-Fiction Computing & I.T.Computer Security Data Encryption Computer Programming & Software Development Programming & Scripting Languages Computer Networking & Communications Network Security Operating Systems UNIX Booktopia Publisher Services John Wiley & Sons Publishers UK

Foreword	p. xiii
Introduction	p. xv
What Is a Rootkit?	p. xvi
Why FreeBSD?	p. xvi
The Goals of This Book	p. xvi
Who Should Read This Book?	p. xvi
Contents Overview	p. xvi
Conventions Used in This Book	p. xvii
Concluding Remarks	p. xvii
Loadable Kernel Modules	p. 1
Module Event Handler	p. 2
The DECLARE_MODULE Macro	p. 3
"Hello, world!"	p. 4
System Call Modules	p. 6
The System Call Function	p. 6
The sysent Structure	p. 7
The Offset Value	p. 8
The SYSCALL_MODULE Macro	p. 8
Example	p. 9
The modfind Function	p. 10
The modstat Function	p. 10
The syscall Function	p. 11
Executing the System Call	p. 11
Executing the System Call Without C Code	p. 12
Kernel/User Space Transitions	p. 12
The copyin and copyinstr Functions	p. 13
The copyout Function	p. 13
The copystr Function	p. 13
Character Device Modules	p. 14
The cdevsw Structure	p. 14
Character Device Functions	p. 15
The Device Registration Routine	p. 16
Example	p. 17
Testing the Character Device	p. 19
Linker Files and Modules	p. 21
Concluding Remarks	p. 22
Hooking	p. 23
Hooking a System Call	p. 24
Keystroke Logging	p. 26
Kernel Process Tracing	p. 28
Common System Call Hooks	p. 29
Communication Protocols	p. 30
The protosw Structure	p. 30
The inetsw Switch Table	p. 31
The mbuf Structure	p. 32
Hooking a Communication Protocol	p. 32
Concluding Remarks	p. 33
Direct Kernel Object Manipulation	p. 37
Kernel Queue Data Structures	p. 37
The LIST_HEAD Macro	p. 38
The LIST_HEAD_INITIALIZER Macro	p. 38
The LIST_ENTRY Macro	p. 38
The LlST_FOREACH Macro	p. 39
The LIST_REMOVE Macro	p. 39
Synchronization Issues	p. 39
The mtx_lock Function	p. 40
The mtx_unlock Function	p. 40
The sx_slock and sx_xlock Functions	p. 40
The sx_sunlock and sx_xunlock Functions	p. 41
Hiding a Running Process	p. 41
The proc Structure	p. 41
The allproc List	p. 42
Example	p. 43
Hiding a Running Process Redux	p. 46
The hashinit Function	p. 47
pidhashtbl	p. 47
The pfind Function	p. 48
Example	p. 48
Hiding with DKOM	p. 51
Hiding an Open TCP-based Port	p. 52
The inpcb Structure	p. 52
The tcbinfo.listhead List	p. 53
Example	p. 54
Corrupting Kernel Data	p. 56
Concluding Remarks	p. 57
Kernel Object Hooking	p. 59
Hooking a Character Device	p. 59
The cdevp_list and cdev_priv Structures	p. 60
The devmtx Mutex	p. 60
Example	p. 60
Concluding Remarks	p. 62
Run-Time Kernel Memory Patching	p. 63
Kernel Data Access Library	p. 63
The kvm_openfiles Function	p. 64
The kvm_nlist Function	p. 64
The kvm_geterr Function	p. 65
The kvm_read Function	p. 65
The kvm_write Function	p. 65
The kvm_close Function	p. 66
Patching Code Bytes	p. 66
Understanding x86 Call Statements	p. 70
Patching Call Statements	p. 70
Allocating Kernel Memory	p. 73
The malloc Function	p. 73
The MALLOC Macro	p. 74
The free Function	p. 74
The FREE Macro	p. 74
Example	p. 75
Allocating Kernel Memory from User Space	p. 77
Example	p. 77
Inline Function Hooking	p. 81
Example	p. 82
Gotchas	p. 88
Cloaking System Call Hooks	p. 88
Concluding Remarks	p. 90
Putting It All Together	p. 91
What HIDSes Do	p. 91
Bypassing HIDSes	p. 92
Execution Redirection	p. 92
File Hiding	p. 96
Hiding a KLD	p. 101
The linker_files List	p. 102
The linker_file Structure	p. 102
The modules List	p. 103
The module Structure	p. 103
Example	p. 104
Preventing Access, Modification, and Change Time Updates	p. 107
Change Time	p. 108
Example	p. 112
Proof of Concept: Faking Out Tripwire	p. 114
Concluding Remarks	p. 117
Detection	p. 119
Detecting Call Hooks	p. 120
Finding System Call Hooks	p. 120
Defecting DKOM	p. 123
Finding Hidden Processes	p. 123
Finding Hidden Ports	p. 125
Defecting Run-Time Kernel Memory Patching	p. 125
Finding Inline Function Hooks	p. 125
Finding Code Byte Patches	p. 125
Concluding Remarks	p. 126
Closing Words	p. 127
Bibliography	p. 129
Index	p. 131
Table of Contents provided by Ingram. All Rights Reserved.

Designing Bsd Rootkits

At a Glance

Paperback

Shipping

How to return your order

Defective items

You Can Find This Book In

More in Operating Systems

macOS Tahoe For Dummies

For Dummies (Computer/Tech)

Microsoft Power BI Step by Step

Windows 11 For Seniors For Dummies, 2nd Edition

For Dummies (Computer/Tech)

Principles of Operating Systems

Windows 11 For Dummies, 2nd Edition

Windows 11 For Dummies

Laws of UX

2nd Edition - Using Psychology to Design Better Products & Services

Linux All-In-One For Dummies

For Dummies (Computer/Tech)

This is Service Design Doing

Applying Service Design Thinking in the Real World

Don't Make Me Think, Revisited

A Common Sense Approach to Web Usability

The Site Reliability Workbook

Practical ways to implement SRE

Product Leadership

How Top Product Managers Launch Awesome Products and Build Successful Teams

Mapping Experiences

A Complete Guide to Creating Value through Journeys, Blueprints, and Diagrams 2nd Edition

Windows 11 All-in-One For Dummies, 2nd Edition

For Dummies

Windows 11 for Seniors in Easy Steps

In Easy Steps

iPad & iPad Pro for Dummies

2024-2025 Edition

Modern Operating Systems, Global Edition

5th Edition

UNIX and Linux System Administration Handbook

5th Edition

Git : Pocket Guide

A Working Introduction

UX Strategy

How to Devise Innovative Digital Products that People Want 2nd Edition

TCP/IP Network Administration 3e

O'Reilly Ser.

Understanding the Linux Kernel

O'Reilly Ser.

Escaping the Build Trap

How Effective Product Management Creates Real Value

Bash Pocket Reference

Help for Power Users and Sys Admins : 2nd Edition

CompTIA A+ Certification All-in-One Exam Guide (Exams 220-1101 & 220-1102)

11th Edition

This product is categorised by