Summary


We now have a rootkit that does the following:

  • Hides its device driver entry

  • Hides its configuration file

  • Hooks the operating system kernel

  • Hooks selected processes loaded by the operating system

  • Processes commands sent from user mode applications

  • Communicates with a remote controller

Though this chapter only details the initial remote control connection, it should be enough to get started. Once a connection is initiated, a polling routine can check for remote commands; and a command parsing routine can provide the remote controller with any desired functionality. The next chapter introduces filter drivers.




Professional Rootkits
Professional Rootkits (Programmer to Programmer)
ISBN: 0470101547
EAN: 2147483647
Year: 2007
Pages: 229
Authors: Ric Vieler

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net