Purchased Rootkits | Subverting the Windows Kernel


A month ago I have bought Rootkits, Subverting the Windows Kernel by Greg Hoglund and James Butler and I find it superb.  If you are a rootkit developer or looking to be one, this is a must have book that you need to get a hold of.  It teaches you generally the stuffs you want to learn such as hiding processes, files and directories, registries and lots more.  Conquering the kernel level as well as beating up Antiviruses are one of the topics that are discussed on!  Recently I am busy with my final years so I hope I can find time to post some useful articles.

Are you a rootkit developer?


Are you a rootkit developer?  Can you fulfill my idea in the Ideas and Challenges page?  I am looking for some articles or any resources that can help me solve the following.

  • Hide a process
  • Hide a file
  • Hide a registry
  • Hide a port
  • Contact userland application, vice versa
  • Keystroke logging

If you by chance come across any articles or books related to this please do let me know!

Creating your own driver loader in C | Driver Loader | Source Code | Rootkit


Technically, there’s 2 way of loading a rootkit according to Greg Hoglund when he wrote Rootkits: Subverting the Windows Kernel book.  One is called The Quick-And-Dirty Way to Load a Driver.  This method allows you to “load a driver into the kernel without having to create any registry keys.  “Pageable” refers to memory that can be swapped to disk. If a driver is pageable, any part of the driver could be paged out (that is, swapped from memory to disk). Sometimes when memory is paged out, it cannot be accessed; an attempt to do so will result in the infamous Blue Screen of Death (a system crash)” by using an undocumented API call.  Read the rest of this entry »

Rootkits | Subverting the Windows Kernel


Are you a programmer that loves to design malicious application?  Do you find malicious applications that you have made are easily detected by anti-virus software (oh come on, Fully Un-detectable (FUD) isn’t going to last long)?  Do you know the difference of user and kernel space?  Ever wanted to be able to stay on the same level as the anti-virus as well as getting rid of it?

Take yourself into a whole new level by learning how to develop a rootkit! Read the rest of this entry »