Rootkits: Subverting the Windows Kernel: Subverting the Windows Kernel
Thumbnail 1Thumbnail 2Thumbnail 3

Rootkits: Subverting the Windows Kernel: Subverting the Windows Kernel

4.6/5
产品编号: 53126143
安全交易
经常一起购买

描述

Rootkits: Subverting the Windows Kernel: Subverting the Windows Kernel

评论

4.6

全部来自已验证的购买

D**M

The content is good, but it's a tough read

The content is good, but it's a tough read. Even if you're experienced with Windows development and techniques that are used in the book, it's not an enjoyable read but more of a heavy slog. Many more texts are making infosec topics more approachable,. To be very honest I'd rather spend time with Windows Internals than this book, but that said it's a quality source on the subject topic hence the 4 stars.

H**I

Just another one of those proud owners of this book ...

Just another one of those proud owners of this book yes the price is very steep but dam the material ))) loving it

L**E

In Depth Technical Read

Great read, if your looking some in depth technical content read to stimulate the mind this will do it.

M**H

Rootkits: Subverting the Windows Kernel

Rootkits are defined as a set of programs and code that allows a permanent or consistent, undetectable presence on a computer. The "root" denotes the all powerful superuser in the UNIX systems. Though no such account exists in windows the use rootkit applies to a piece of code that resides in the machine , which is generally undetectable and allows the owner of the code to have administrative rights on the windows machine on which it is running. Rootkits have been in prominence in the recent past due to the Sony's infamous DRM. Apparently that could be described as "benevolent" use of rootkits. This is one of the many first books to come on in the recent past. The knowledge of rootkits were not available to general public till recently. The book describes in detail the different classes of rootkits that could be found in windows operating system and their mechanism of operation. There still exists a vacuum of a book on rootkit in Unix operating systems. Rootkits were known to be more prevalent in Unix versions than windows systems. The book describes in detail the mechanisms of action of rootkits and does describe briefly the methods for detection of rootkits. The book has been an end result of the authors long interest in rootkits, the author has setup a website and forum named rootkit which bears the same name. The book looks at the possible ways of subverting the operating system. This includes looking at both the software and hardware methods that could be used. It also looks at the possible methods of detection and describes them in lesser details. Each of methods of subverting the operating is described in detail with sample pieces of code. The book should allow a reader with a reasonable knowledge of programming and windows architecture to create variants of rootkits described or create new ones.The concept of rootkits have been around in the unix world for a while. The generic concepts of rootkits have remained more or less the same over the past few years. The methods of operation of rootkits in windows might chance as a result of change in architecture to windows. This is especially relevant as the rootkits depend on windows device driver architecture, hence any changes in windows would make the techniques described in the book obsolete. Yet the generic methods that are described would remain valid.The book starts off with a chapter aptly titled Leave No Trace it goes on to give a brief description of how do rootkits works. The it continues with high level description on HIPS and NIDS and how those might detect a rootkilt. The chapter also have a short history of rootkits. The second chapter titled Subverting the Kernel starts of with an introduction into device drivers in windows. It goes on describe how compile device drivers and debug them. It also describes the process of loading and unloading device drivers (or rootkits). There is also a high level description of structure of rootkit.There has been quite a lot of talk about Covert Channels in the past. The authors too delve a bit into the possibility of using covert channels , the possible ways of using TCP/IP is discussed. The last chapter is dedicated to Rootkit Detection. The authors take a short description of methods for detecting rootkits. The detection of root kits by analysis of behavior looking at entries in registries and other methods. The rootkit.com is again referred here and resources discussed in the book could be found there.The book assumes a working knowledge of programming in C especially pointers, as code samples are written in C. For running the samples that comes along with the book, some of them would need a copy of device driver kit and a C compiler. It would also assume an idea of Windows device driver architecture, as it an understanding of the device driver architecture could come in handy. It is first of the books to appear solely devoted to rootkits, although some of it have been briefly discussed in some books notably Exploiting Software: How to Break Code, which shares one of the authors.The author assumes Intel architecture and windows operating system . The operating system recommended would be windows 2000 or later, the device driver architecture has undergone changes from windows 98 to windows 2000 and backward compatibility is not present.The book is very readable and the language is clear and lucid. The technical contents of the book are accurate. The samples that are included in the book are straightforward and easy to follow. The book is supplemented by rootkit.com with more samples and resources. The illustrations are used only in the places where it’s necessary and they are helpful in understanding the concepts described.

C**1

Five Stars

all good

常见问题

TrustPilot

TrustScore 4.5 | 7,300多个评论

伊姆兰 F.

非常可靠的商店,产品真实可靠。一定会再次购买!

2 周前

Anjali K.

产品质量出色。正是我的工作所需要的。

1 个月前

全球购物,通过 Desertcart 享受优惠
物有所值
各种产品的价格具有竞争力
全球购物
为 100 多个国家的数百万购物者提供服务
增强保护
深受全球购物者喜爱的值得信赖的支付方式
客户保证
深受全球购物者喜爱的值得信赖的支付方式。
沙漠车应用程序
随时随地随时随地购物。
HK$939

关税和税费包括

Hong Kong店铺
1
免运费

with PRO Membership

免费退货

30天对于 PRO 会员用户

15天无会员资格

安全交易

TrustPilot

TrustScore 4.5 | 7,300多个评论

Anjali K.

产品质量出色。正是我的工作所需要的。

1 个月前

阿里·H.

发货快,包装精良。Leatherman 工具手感非常高档和坚固。

1天前

Rootkits Subverting The Windows Kernel Subverting The Windows Kernel | Desertcart Hong Kong