If you don't own this book, then the world will one day 0wn you. Buy this book today and learn from the masters about the ultimate tool in the attacker's toolkit. Greg Hoglund's work is essential to computer security. It behooves us all to understand it.

One of the first books to go deeper in to rootkits of its kind. Not many books out there to give a understanding to IAT, SSDT, hooks, trampoline functions, and its relationship to rootkits.

Some of the problems with info sec is the lack of information. With more information, others can go from reactive actions to proactive actions.

Having heard the presentations and talks by the authors, the book brings into deeper insights with examples into the world of rootkits. With the rise in malware of all kinds, IT professionals will need to know how a rootkit works and detection.

This book tells me what RootKit really means. One useful thing I got from this book was that in Windows Kernel even simple code can be used against security. And that's it. Most techniques in this book are primitive to kernel developers. I don't recommend this book to serious kernel driver developers. "Windows Internals" and OSR Online should be the way to go.

I bought this book on a whim, and a sale.
I have found the book to be very clearly written, even when the topic can be exceedlingly obscure.

Well worth every cent.

I fully agree with the other reviews I have found on Amazon and cannot offer more insight to the books contents.

I would recommend this book to any serious software developer.
I was impressed to see that was a reference to how the start of a function in Assembly language is shown for XP SP2 - and that it made it easier to find.

My only warning is that you may become a little security paranoid after you find out what can happen.

A brilliantly written book on everything one would want to know about Rootkits in the Microsoft Windows world. Greg is the industry expert who shares his knowledge through many examples and illustrations that would help almost any level of reader grasp a better understanding of Rootkits.

The authors start with `Understanding Attackers' Motives' and what Rootkits are and aren't, and work they way through Rootkit designs, hardware interaction, hooking into kernel and user, `Direct Kernel Object Manipulation', `Hardware Manipulation', covert techniques and ways to identify Rootkits on your systems.

The authors in-depth knowledge of Rootkits is clearly demonstrated early on when they walk through creating a loadable module, or device/kernel driver. Through this process, they take the time to explain each line, how it manipulates the system, and how it could be used maliciously.

Throughout most of the book, the authors give very detailed examples, lines of code and other evidence supporting the theories and processes presented here. The book is written in a way that they leave little to the imagination and provide hard evidence to support the thought.

The book ends with Rootkit detection, which is the only way to end a book on malicious software. Now that they have taught one how to manipulate and hijack system, here is what one can do to protect the systems they are responsible for, and identify these malicious codes on ones systems. They describe scanning memory, identifying different types of hooks, and again provide some code for one to use to help with these processes.

After reading this book, not only will one have the understanding of Rootkits are and how they can be used, one will have enough knowledge to create their own Rootkits, understand key programming techniques such as runtime patching, hooking into the kernel, and remote command and control.

I highly recommend this book as the Rootkit is the `Mother of all Malicious Code'. Once an attacker has successfully installed a Rootkit on one's system, the game is over.

I don't think I've ever seen a book as detailed as this on "subverting" an operating system... Rootkits - Subverting The Windows Kernel by Greg Hoglund and James Butler.

Contents: Leave No Trace; Subverting the Kernel; The Hardware Connection; The Age-Old Art of Hooking; Runtime Patching; Layered Drivers; Hardware Manipulation; Covert Channels; Rootkit Detection; Index

Hoglund and Butler have devoted a lot of time to understanding how the Windows kernel works, as well as how rootkits can be utilized to manipulate the kernel. This knowledge led to the website rootkit.com, and subsequently to this book. They explore the definition of rootkits, how they work, and how they can remain hidden from detection. Using the C language, they go into great depth on how rootkit kernel manipulation can be accomplished. If you have a basic knowledge of C, you'll be able to follow along and learn the intricacies of the kernel.

It'd be tempting to wonder why all this dangerous knowledge should be put in book form for junior hackers to use. For one, this isn't script kiddy material. If you don't know how to program (and in C), the book is basically far over your head. I suppose if you were bent towards building your own rootkit for world domination, this material would help. But in reality, this information is probably already accessible to those who would abuse it in the first place. Having a compiled volume of the information helps "the good guys" understand the risks involved as well as how you can protect yourself from rootkit attacks in your own environment.

While programming geeks will likely get the most value from this book, all security experts need to understand the concepts covered here. The worst thing isn't finding out you've been "owned" with a rootkit on your network. It's *not* knowing the rootkit is there...

I needed info on developing and using Windows drivers, and bought this on a whim. It's a great source of info on how drivers are SUPPOSED to work and on how they CAN work in the wrong hands. Has code examples, and is a total winner.

It is rare to see a book as detailed as this on infiltrating a Microsoft machine. Hoglund and Butler give a serious, hard core technical account of several ways to subvert the operating system by the successful installation and running of a rootkit. A slight irony here. The "root" in rootkit refers to the super user's account name on a unix machine. But the market reality is that Microsoft machines dominate the desktop.

A key appeal of the book is the amount of example code that helps you, the programmer, understand how a rootkit works. While the book certainly gives good high level descriptions of rootkit strategies, the examples make these flesh.

To some of you, it will be saddening to see that certain sections of the book omit those examples. Possibly the authors wanted to veer on the side of caution on those topics.

There does seem to be a slight tension in the book, regarding who would use it. Black hats or white hats. The authors stoutly claim that sometimes you can have perfectly good reasons to design and deploy a rootkit. Granted. But undoubtedly, others will derive nefarious utility from the text.

This is one of those very rare books that reveals for the first time in one place all of the material that is so very hard to obtain from other sources.

Just like "Hacking Exposed" was the first successful security book to reveal what many people feared to disclose yet was already known to the "underground", "Rootkits" packages some of the deepest knowledge on the subject in a relatively readable format. Some of the stuff here, such as programming the TDI API is documentation you will find nowhere else in such an accessible manner.

Recognized experts in their field, Greg Hoglund and James Butler should be commended on creating a must-read book for any security conscious programmer or person wanting a better understanding of this apparently (to some) new field.

Robin Keir
Chief Scientist
Foundstone, Inc.
A division of McAfee, Inc.

Some may wonder if Hoglund and Butler are being irresponsible by writing a book that shows you how to bypass detection. If you look closely, however, you'll see that all of the methods they outline are detectable by current rootkit revealing mechanisms. And they also show you how to detect many new rootkits in the process. I consider this book to be a responsible contribution to the community, professionals and amateurs alike, in the finest tradition full disclosure.

The book is organized into three major sections, even if it's not explicitly marked as such. The first section serves as an introduction to the topic and some of the high level concepts you'll need to know about Windows, control mechanisms, and where you can introduce your code. The second part is a highly technical tour of the techniques used to hook your rootkit in and hide it, And the third section is really one chapter covering detection of rootkits.

The first few chapters, which serve to introduce the topic, get technical right away. Chapter 2, for example, shows you some basic mechanisms for hooking in your rootkit. If you're getting lost at this point, you'll want to probably augment your reading with a Win32 internals book. The resources listed by the authors, though, are great. By this point you can also see that the writing is clear and the examples contribute perfectly to the topic. Hardware hooking basics are covered in chapter 3, which should give you some indication of the book's pace (quick!).

By the time you get to chapter 4 and discussing how to hook into both userland and the kernel, you're getting at some very valuable material. Although the book focuses on kernel hooking, a brief description of userland hooking is provided. Chapter 5 covers runtime patching, a black art that's not well known. This is almost worth the full price of admission, but the material gets even better.

In chapters 6-9 you get into some serious deep voodoo and dark arts. In these chapters you'll learn the basics of direct kernel object manipulation, layered device drivers (which can save you a lot of work), hardware manipulation, and network handling. All of these are techniques used by rootkit authors to varying degrees and effect, so you should become familiar with them. The code examples are clear and functional, and you'll learn enough to write a basic rootkit in only about 150 pages. Simple keyboard sniffers and covert channels are described in the code examples. Useful stuff.

I can't say I found many errors or nits in the book. There's some problems at times getting the code formatting just right, and what appear to be a few stray characters here and there, but nothing too obvious to me. Then again, I'm not a Windows kernel programmer, so I don't feel qualified to comment on the correctness of the code.

In the finest tradition of using a blog and dynamic website to assist your readers, the authors have set up rootkit.com, which nicely supplements their book. Most of the resources they mention in the book are available here, as well as a great array of contributors and evolving techniques. Without the book the site is still useful, but together they're a great combination. Too many books lose their value once you read them, and some books stay with you because you're having difficulty understanding the authors. Rootkits will stay near you while you develop your skills because it's a lot of material in a small space, and although it's very clearly written, there is a deep amount of material to digest. You'll be working with this one for a while.

My only major wish for this book is for it to have covered detection more significantly. One chapter covers how to detect rootkits, and although you may be able to look for some specific telltale signs of rootkits depending on how they were introduced, a more complete coverage of this approach would have made the book even more worthwhile.

Rootkits is an invaluable contribution in the wider understanding of advanced attack and hacker techniques. Previously, much of this material was known to only a handful of people, and assembling your own knowledge base was difficult. Hoglund and Butler write clearly, use great code examples, and deliver an excellent book on a high technical and specialized topic. If you're interested in learning how to write your own rootkit or detect someone else's rootkit on your system, you should definitely start with this book.

Greg Hoglund, co-author of Exploiting Software: How To Break Code, and Jamie Butler have written a comprehensive and authoritative reference for Windows rootkits.

Rootkits does not pull any punches or shy away from sharing details about the exact means and methods for manipulating the operating system and compromising computers at their root, or core, level. Rootkits have existed for some time, but were initially aimed primarily at UNIX systems. Only recently have rootkits for Windows gained attention.

There are those who will argue that a book like this does as much or more to help would-be hackers learn how to develop rootkits as it does to help administrators guard against them. My feeling is that a book like this, which sheds light on exactly how rootkits work and unveils the tricks they use, is necessary to building effective tools and defenses to guard against them.

The authors are progressive, referring frequently to their hacker as a female. The book is not for novices. It assumes some understanding of the C programming language and is aimed more at people who are already computer and/or security savvy, but want to expand that knowledge to include rootkits.

Overall, I highly recommend this excellent book.

[...]

Rootkits: Subverting The Windows Kernel is a must read for black hat and white hat hackers alike. Over the past few years, I've perused a number of the security books on the market. More times than not, I've been disappointed. They have tended to be:

1. Very high level and lacking in technical details (heaven forbid we allow the evil details to fall into the wrong hands ;) !

2. Recipe books for how to perform documented attacks (useless for serious hackers / security professionals interested in innovating / defending against cutting edge atacks).

3. Focus primarily on network based instrusion as opposed to underlying structural weaknesses / attack vectors in applications and the operating system.

I am happy to write this review because Greg and Jamie's book doesn't fall into any of the 3 categories listed above. Having been involved in rootkit development myself and a contributor on rootkit.com, I applaud their unflinchingly technical, yet down to earth treatment of a difficult subject.

First, this book does not lack in gory details. Best of all, there should be something here for everyone to learn. It does a good treatment of the basic concepts like IAT and SSDT hooking, but there is also enough to appeal to more experienced developers. I particularly enjoyed seeing some advanced topics discussed like file filter drivers and multi-processor synchronization issues involved in DKOM attacks.

Although the subject matter is somewhat esoteric by nature, Greg and Jamie do a good job of providing code snippets and walk-throughs. And added bonus is the fact that much of the remaining code is available online at rootkit.com.

Lastly, I want to mention that this book is unique among most commercial computer security books in that it takes a blatently offensive rather than a defensive perspective. I found this refreshing. Lets face it: most serious black hats already have the "evil details". Rather than practicing security through obsecurity, Greg and Jamie's full disclosure approach makes this important information available to the white hats and security professionals who need it the most!

All in all, great job guys --> 10/10 !!!

Technical books tend to be either "about things" or "how to do things" with how to being far rarer and generally more valuable. Hoglund and Butler are true authorities on this subject and yet they never brag, instead they focus on helping the rest of us understand what is possible and exactly how it can be done.

Once again, the Addison-Wesley team demonstrates excellence, I found a couple of sentences that could benefit from a rewrite, but no grammar or spelling errors. The charts and code examples are done well and the layout never detracts from the message.

I enjoyed learning about the VICE, patchfinder 2 and Rootkit Revealer tools and can't wait to run them on some of the older laptops in the company that have been used as loaners. I expect that will be revealing!

This was the clearest explanation I have ever seen as to how networking is managed using the Transport Data Inferface. Even so, it still left me just a bit "hungry" and I hope this section is expanded in the second edition of this book.

What impressed me the most though was when the authors reached the limits of their knowledge, after all, this is a developing art and no one understands everything, with areas such as microcode update they simply and frankly stated that.

Clear, pragmatic, authoritative, what's not to like, buy this book.

When two top authorities on the field of rootkit technology get together to write a book, one can only expect the very best from the book. Jamie Butler and Greg Hoglund are able to take a beginner into the world of kernel development, and through all the ropes the way a lot of device driver books strive to do. The authors give a detailed description of how to setup the DDK so that the reader can compile the code in the book, and if that isn't enough they run www.rootkit.com so questions about the book or code can be posted and possibly answered by the author!
The book is not just for beginners who want to learn what the SSDT is and how to hook, it also covers very advanced techniques such as hooking the TCP device, a line by line walk through of Klog and FU, and details on how to detect kernel rootkits. This book is for everyone from blackhats to whitehats- from student to teacher it needs to be on the shelf of every computer lab out there.

What is a rootkit? - As defined by the authors it is - "A set of programs and code that allows a permanent and undetectable presence on a computer".
This book provides useful knowledge to identify the risks and threats in the Windows kernel which will definitely be an aide for OS researchers, kernel developers and security experts world-wide to make operating systems more solid and secure. Most of its concepts are applicable to other operating systems like Linux as well.
The authors, Mr. Hoglund and Mr. Butler have done a great job by explaining the concepts with samples of code written in C. It gives better insight when a topic has hands-on examples rather than just reading paragraphs about it. It is different in a way as it decribes ways to stay in the system after the compromise instead of only crafting direct attacks to the system.

The technique of inserting hooks at kernel level wherein the rootkit will be on the equal footing of the detection software requires a lot of creativity and imagination. Being well versed with all the techniques described in this book provides a base to the defenders to be two steps ahead of the attackers and introduce a sturdy kernel design/development. The book concludes gracefully with an in-depth study of detecting such hooks in the system completing the circle of information.

I would highly recommend this book as reference material for security programmers, researchers, device driver developers,computer science & engineering students diving into operating systems' kernel as a part of their academic programme, since this book is well-written to target both novice and advanced readers. Wonderful topic and immense use to one of the most upcoming technologies in computer security - Forensic Analysis".
Identifying threats leads to fastest treatment and this book implies that very well.

Rootkits are a hot topic in Windows security this year. You cannot go to a computer security conference anymore without at least two talks on the topic, either about improving the ways to subvert the operating system or about the newest methods for detecting this behavior. The research on both sides is a fast-changing body of knowledge. Butler and Hoglund's book captures the state-of-the-art in this field. The information is very fresh, and delivers thorough coverage on what's out there to date.

Kernel programming -- and more specifically, hacking the undocumented internals of a closed source OS's kernel -- is one of the most challenging tasks in programming. The authors handle this well, walking the fine line between assuming too much of their reader and wasting time on fundamental concepts. The intended audience will have good knowledge of Intel x86 architecture and experience with C programming. But, if this is your first experience with rootkits, the book is an excellent resource and will get you up to speed. Likewise, if you have already experimented with rootkits of your own, this book is the perfect reference material. Indeed it's the only book that has yet been written on the topic.

As computer security gains in importance, skills that were previously black arts (reverse engineering, disassembling, shellcode authoring, kernel hacking, etc) are finally moving above-ground, and I think this is a good thing. This book is part of that movement.

This book should have broad appeal. I recommend it to device driver developers, blackhat hackers that need to cover their tracks, security researchers, and anyone wanting a better understanding of the Windows kernel.