Conclusion

This chapter has armed you with the basics of device-driver development for Windows. We described some of the key areas that can be targeted in the kernel. We also covered the mundane details of setting up your development environment and tools to make rootkit development easier. Finally, we covered the basic requirements for loading, unloading, and starting a driver. We also touched upon deployment methods, and ways to make a driver start on system boot.

The subjects covered in this chapter are required for writing rootkits for MS-Windows. At this point, you should be able to write a simple "hello world" rootkit, and load and unload it from the kernel. You also should be able to write a user-mode program that can communicate with a kernel-mode driver.

In subsequent chapters, we will delve much deeper into the workings of the kernel and the underlying hardware that supports all software. By beginning with the lowest-level structures, you can build correct understandings that enable you to synthesize knowledge of the highest-level elements. This is how you will become a master of rootkits.