Rootkits: Subverting the Windows Kernel and over one million other books are available for Amazon Kindle. Learn more
CDN$ 42.83
  • List Price: CDN$ 67.99
  • You Save: CDN$ 25.16 (37%)
Only 1 left in stock (more on the way).
Ships from and sold by
Gift-wrap available.
Add to Cart
Have one to sell?
Flip to back Flip to front
Listen Playing... Paused   You're listening to a sample of the Audible audio edition.
Learn more
See this image

Rootkits: Subverting the Windows Kernel Paperback – Jul 22 2005

Amazon Price New from Used from
Kindle Edition
"Please retry"
"Please retry"
CDN$ 42.83
CDN$ 42.83 CDN$ 5.65

Join Amazon Student in Canada

Frequently Bought Together

Customers buy this book with Exploiting Software: How to Break Code CDN$ 42.83

Rootkits: Subverting the Windows Kernel + Exploiting Software: How to Break Code
Price For Both: CDN$ 85.66

Show availability and shipping details

  • This item: Rootkits: Subverting the Windows Kernel

    In Stock.
    Ships from and sold by
    FREE Shipping. Details

  • Exploiting Software: How to Break Code

    In Stock.
    Ships from and sold by
    FREE Shipping. Details

Customers Who Bought This Item Also Bought


Product Details

What Other Items Do Customers Buy After Viewing This Item?

Customer Reviews

There are no customer reviews yet on
5 star
4 star
3 star
2 star
1 star

Most Helpful Customer Reviews on (beta) 25 reviews
55 of 56 people found the following review helpful
be an elite hacker d00d! Aug. 19 2005
By jose_monkey_org - Published on
Format: Paperback
Some may wonder if Hoglund and Butler are being irresponsible by writing a book that shows you how to bypass detection. If you look closely, however, you'll see that all of the methods they outline are detectable by current rootkit revealing mechanisms. And they also show you how to detect many new rootkits in the process. I consider this book to be a responsible contribution to the community, professionals and amateurs alike, in the finest tradition full disclosure.

The book is organized into three major sections, even if it's not explicitly marked as such. The first section serves as an introduction to the topic and some of the high level concepts you'll need to know about Windows, control mechanisms, and where you can introduce your code. The second part is a highly technical tour of the techniques used to hook your rootkit in and hide it, And the third section is really one chapter covering detection of rootkits.

The first few chapters, which serve to introduce the topic, get technical right away. Chapter 2, for example, shows you some basic mechanisms for hooking in your rootkit. If you're getting lost at this point, you'll want to probably augment your reading with a Win32 internals book. The resources listed by the authors, though, are great. By this point you can also see that the writing is clear and the examples contribute perfectly to the topic. Hardware hooking basics are covered in chapter 3, which should give you some indication of the book's pace (quick!).

By the time you get to chapter 4 and discussing how to hook into both userland and the kernel, you're getting at some very valuable material. Although the book focuses on kernel hooking, a brief description of userland hooking is provided. Chapter 5 covers runtime patching, a black art that's not well known. This is almost worth the full price of admission, but the material gets even better.

In chapters 6-9 you get into some serious deep voodoo and dark arts. In these chapters you'll learn the basics of direct kernel object manipulation, layered device drivers (which can save you a lot of work), hardware manipulation, and network handling. All of these are techniques used by rootkit authors to varying degrees and effect, so you should become familiar with them. The code examples are clear and functional, and you'll learn enough to write a basic rootkit in only about 150 pages. Simple keyboard sniffers and covert channels are described in the code examples. Useful stuff.

I can't say I found many errors or nits in the book. There's some problems at times getting the code formatting just right, and what appear to be a few stray characters here and there, but nothing too obvious to me. Then again, I'm not a Windows kernel programmer, so I don't feel qualified to comment on the correctness of the code.

In the finest tradition of using a blog and dynamic website to assist your readers, the authors have set up, which nicely supplements their book. Most of the resources they mention in the book are available here, as well as a great array of contributors and evolving techniques. Without the book the site is still useful, but together they're a great combination. Too many books lose their value once you read them, and some books stay with you because you're having difficulty understanding the authors. Rootkits will stay near you while you develop your skills because it's a lot of material in a small space, and although it's very clearly written, there is a deep amount of material to digest. You'll be working with this one for a while.

My only major wish for this book is for it to have covered detection more significantly. One chapter covers how to detect rootkits, and although you may be able to look for some specific telltale signs of rootkits depending on how they were introduced, a more complete coverage of this approach would have made the book even more worthwhile.

Rootkits is an invaluable contribution in the wider understanding of advanced attack and hacker techniques. Previously, much of this material was known to only a handful of people, and assembling your own knowledge base was difficult. Hoglund and Butler write clearly, use great code examples, and deliver an excellent book on a high technical and specialized topic. If you're interested in learning how to write your own rootkit or detect someone else's rootkit on your system, you should definitely start with this book.
50 of 56 people found the following review helpful
Best security book I have read this year Aug. 15 2005
By Stephen Northcutt - Published on
Format: Paperback
Technical books tend to be either "about things" or "how to do things" with how to being far rarer and generally more valuable. Hoglund and Butler are true authorities on this subject and yet they never brag, instead they focus on helping the rest of us understand what is possible and exactly how it can be done.

Once again, the Addison-Wesley team demonstrates excellence, I found a couple of sentences that could benefit from a rewrite, but no grammar or spelling errors. The charts and code examples are done well and the layout never detracts from the message.

I enjoyed learning about the VICE, patchfinder 2 and Rootkit Revealer tools and can't wait to run them on some of the older laptops in the company that have been used as loaners. I expect that will be revealing!

This was the clearest explanation I have ever seen as to how networking is managed using the Transport Data Inferface. Even so, it still left me just a bit "hungry" and I hope this section is expanded in the second edition of this book.

What impressed me the most though was when the authors reached the limits of their knowledge, after all, this is a developing art and no one understands everything, with areas such as microcode update they simply and frankly stated that.

Clear, pragmatic, authoritative, what's not to like, buy this book.
20 of 21 people found the following review helpful
A must for those desiring knowledge on the "Mother of all Malware"! Oct. 2 2005
By Charles Hornat - - Published on
Format: Paperback
A brilliantly written book on everything one would want to know about Rootkits in the Microsoft Windows world. Greg is the industry expert who shares his knowledge through many examples and illustrations that would help almost any level of reader grasp a better understanding of Rootkits.

The authors start with `Understanding Attackers' Motives' and what Rootkits are and aren't, and work they way through Rootkit designs, hardware interaction, hooking into kernel and user, `Direct Kernel Object Manipulation', `Hardware Manipulation', covert techniques and ways to identify Rootkits on your systems.

The authors in-depth knowledge of Rootkits is clearly demonstrated early on when they walk through creating a loadable module, or device/kernel driver. Through this process, they take the time to explain each line, how it manipulates the system, and how it could be used maliciously.

Throughout most of the book, the authors give very detailed examples, lines of code and other evidence supporting the theories and processes presented here. The book is written in a way that they leave little to the imagination and provide hard evidence to support the thought.

The book ends with Rootkit detection, which is the only way to end a book on malicious software. Now that they have taught one how to manipulate and hijack system, here is what one can do to protect the systems they are responsible for, and identify these malicious codes on ones systems. They describe scanning memory, identifying different types of hooks, and again provide some code for one to use to help with these processes.

After reading this book, not only will one have the understanding of Rootkits are and how they can be used, one will have enough knowledge to create their own Rootkits, understand key programming techniques such as runtime patching, hooking into the kernel, and remote command and control.

I highly recommend this book as the Rootkit is the `Mother of all Malicious Code'. Once an attacker has successfully installed a Rootkit on one's system, the game is over.
15 of 16 people found the following review helpful
Required reading for security professionals and developers... Sept. 24 2005
By Thomas Duff - Published on
Format: Paperback
I don't think I've ever seen a book as detailed as this on "subverting" an operating system... Rootkits - Subverting The Windows Kernel by Greg Hoglund and James Butler.

Contents: Leave No Trace; Subverting the Kernel; The Hardware Connection; The Age-Old Art of Hooking; Runtime Patching; Layered Drivers; Hardware Manipulation; Covert Channels; Rootkit Detection; Index

Hoglund and Butler have devoted a lot of time to understanding how the Windows kernel works, as well as how rootkits can be utilized to manipulate the kernel. This knowledge led to the website, and subsequently to this book. They explore the definition of rootkits, how they work, and how they can remain hidden from detection. Using the C language, they go into great depth on how rootkit kernel manipulation can be accomplished. If you have a basic knowledge of C, you'll be able to follow along and learn the intricacies of the kernel.

It'd be tempting to wonder why all this dangerous knowledge should be put in book form for junior hackers to use. For one, this isn't script kiddy material. If you don't know how to program (and in C), the book is basically far over your head. I suppose if you were bent towards building your own rootkit for world domination, this material would help. But in reality, this information is probably already accessible to those who would abuse it in the first place. Having a compiled volume of the information helps "the good guys" understand the risks involved as well as how you can protect yourself from rootkit attacks in your own environment.

While programming geeks will likely get the most value from this book, all security experts need to understand the concepts covered here. The worst thing isn't finding out you've been "owned" with a rootkit on your network. It's *not* knowing the rootkit is there...
9 of 9 people found the following review helpful
The definitive text on Windows rootkits, applicable in 2005 or 2007 June 23 2007
By Richard Bejtlich - Published on
Format: Paperback
I read Rootkits: Subverting the Windows Kernel last year, but waited until I read Joseph Kong's Designing BSD Rootkits before reviewing both books. In a head-to-head comparison, I thought Kong's book was easier to comprehend and directly covered the key techniques I wanted to see. If I could give this book 4 1/2 stars I would, but Amazon doesn't allow that luxury.

Hoglund and Butler should be commended for writing this book. It really does assemble the parts (meaning techniques and code) necessary to implement a Windows rootkit, at least prior to Windows Vista. My only concern is that, at times, the authors are not as clear as I hoped they might be. This is probably due to the fact that they are two of the best rootkit writers on the planet, so they probably do not remember what it was like to not understand "hooking" and other techniques.

In some ways Rootkits is probably a book best suited for other experts (like many who wrote reviews here). That leaves beginners (like myself) wishing for a little more foundation or direct language prior to reading about implementation tricks.

One of the greatest strengths of this book, however, is the degree to which it exposes the internal workings of Windows. For greatest effect it's probably worth reading Microsoft Windows Internals, Fourth Edition by Russinovich and Solomon first.

Note that although I found the direct approach of the BSD rootkits book better for my learning style, this book by Hoglund and Butler is deeper in several areas. In fact, those who liked the BSD rootkits book would do well to read its Windows counterpart to learn tricks from Hoglund and Butler.