Rootkits: Subverting the Windows Kernel and over one million other books are available for Amazon Kindle. Learn more
  • List Price: $64.99
  • Save: $22.98 (35%)
Only 13 left in stock (more on the way).
Ships from and sold by
Gift-wrap available.
Add to Cart
FREE Shipping on orders over $35.
Condition: Used: Very Good
Comment: GREAT SHAPE! Softcover. No missing/torn pages, highlighting, or underlining in text. Some light wear, corner creasing. Fulfilled by Amazon! Free shipping on total Amazon fulfilled orders over $25! Free 2-Day shipping with Amazon Prime!
Add to Cart
Have one to sell? Sell on Amazon
Flip to back Flip to front
Listen Playing... Paused   You're listening to a sample of the Audible audio edition.
Learn more
See this image

Rootkits: Subverting the Windows Kernel Paperback – August 1, 2005

See all 3 formats and editions Hide other formats and editions
Amazon Price New from Used from
"Please retry"
"Please retry"
$25.98 $5.54

Frequently Bought Together

Rootkits: Subverting the Windows Kernel + The Rootkit Arsenal: Escape and Evasion in the Dark Corners of the System + Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code
Price for all three: $124.98

Buy the selected items together


Shop the new
New! Introducing the, a hub for Software Developers and Architects, Networking Administrators, TPMs, and other technology professionals to find highly-rated and highly-relevant career resources. Shop books on programming and big data, or read this week's blog posts by authors and thought-leaders in the tech industry. > Shop now

Product Details

  • Paperback: 352 pages
  • Publisher: Addison-Wesley Professional (August 1, 2005)
  • Language: English
  • ISBN-10: 0321294319
  • ISBN-13: 978-0321294319
  • Product Dimensions: 9.8 x 6.3 x 0.8 inches
  • Shipping Weight: 1.4 pounds (View shipping rates and policies)
  • Average Customer Review: 4.3 out of 5 stars  See all reviews (25 customer reviews)
  • Amazon Best Sellers Rank: #342,398 in Books (See Top 100 in Books)

Editorial Reviews

About the Author

Greg Hoglund has been a pioneer in the area of software security. He is CEO of HBGary, Inc., a leading provider of software security verification services. After writing one of the first network vulnerability scanners (installed in over half of all Fortune 500 companies), he created and documented the first Windows NT-based rootkit, founding in the process. Greg is a frequent speaker at Black Hat, RSA, and other security conferences.

James Butler, Director of Engineering at HBGary, has a world-class talent for kernel programming and rootkit development and extensive experience in host-based intrusion-detection systems. He is the developer of VICE, a rootkit detection and forensics system. Jamie's previous positions include Senior Security Software Engineer at Enterasys and Computer Scientist at the National Security Agency. He is a frequent trainer and speaker at Black Hat security conferences. He holds a masters of computer science from the University of Maryland, Baltimore County. He has published articles in the IEEE Information Assurance Workshop, Phrack, USENIX ;login:, and Information Management and Computer Security.

Excerpt. © Reprinted by permission. All rights reserved.

A rootkit is a set of programs and code that allows a permanent and undetectable presence on a computer.

Historical Background

We became interested in rootkits because of our professional work in computer security, but the pursuit of the subject quickly expanded into a personal mission (also known as late nights and weekends). This led Hoglund to found, a forum devoted to reverse engineering and rootkit development. Both of us are deeply involved with Butler first contacted Hoglund online through this Web site because Butler had a new and powerful rootkit called FU that needed testing, 1 Butler sent Hoglund some source code and a pre-compiled binary. However, by accident, he did not send Hoglund the source code to the kernel driver. To Butler's amazement, Hoglund just loaded the pre-compiled rootkit onto his workstation without question, and reported back that FU seemed to be working fine! Our trust in one another has only grown since then. 2

Both of us have long been driven by an almost perverse need to reverse-engineer the Windows kernel. It's like when someone says we can't do something--then we accomplish it. It is very satisfying learning how so-called computer security products work and finding ways around them. This inevitably leads to better protection mechanisms.

The fact that a product claims to provide some level of protection does not necessarily mean it actually does. By playing the part of an attacker, we are always at an advantage. As the attacker we must think of only one thing that a defender didn't consider. Defenders, on the other hand, must think of every possible thing an attacker might do. The numbers work in the attacker's favor.

We teamed up a few years ago to offer the training class "Offensive Aspects of Rootkit Technology." This training started as a single day of material that since has grown to include hundreds of pages of notes and example code. The material for the class eventually became the foundation for this book. We now offer the rootkit training class several times a year at the Black Hat security conference, and also privately.

After training for awhile, we decided to deepen our relationship, and we now work together at HBGary, Inc. At HBGary, we tackle very complex rootkit problems on a daily basis. In this book, we use our experience to cover the threats that face Windows users today, and likely will only increase in the future.

Target Audience

This book is intended for those who are interested in computer security and want a truer perspective concerning security threats. A lot has been written on how intruders gain access to computer systems, but little has been said regarding what can happen once an intruder gains that initial access. Like the title implies, this book will cover what an intruder can do to cover her presence on a compromised machine.

We believe that most software vendors, including Microsoft, do not take rootkits seriously. That is why we are publishing this book. The material in this book is not groundbreaking for someone who has worked with rootkits or operating systems for years--but for most people this book should prove that rootkits are a serious threat. It should prove that your virus scanner or desktop firewall is never good enough. It should prove that a rootkit can get into your computer and stay there for years without you ever knowing about it.

To best convey rootkit information, we wrote most of this book from an attacker's perspective; however, we end the book on a defensive posture. As you begin to learn your attackers' goals and techniques, you will begin to learn your own system's weaknesses and how to mitigate its shortcomings. Reading this book will help you improve the security of your system or help you make informed decisions when it comes to purchasing security software.


As all of the code samples are written in C, you will gain more insight if you already understand basic C concepts--the most important one being pointers. If you have no programming knowledge, you should still be able to follow along and understand the threats without needing to understand the particular implementation details. Some areas of the book draw on principles from the Windows device driver architecture, but experience writing device drivers is not required. We will walk you through writing your first Windows device driver and build from there.


This book covers Windows rootkits, although most of the concepts apply to other operating systems as well, such as LINUX. We focus on kernel rootkits because these are the most difficult to detect. Many public rootkits for Windows are userland rootkits 3 because these are the easiest to implement, since they do not involve the added complexity of understanding how the undocumented kernel works.

This book is not about specific real-world rootkits. Rather, it teaches the generic approaches used by all rootkits. In each chapter, we introduce a basic technique, explain its purposes, and show how it's implemented using code examples. Armed with this information, you should be able to expand the examples in a million different ways to perform a variety of tasks. When working in the kernel, you are really limited only by your imagination.

You can download most of the code in this book from Throughout the book, we will reference the particular URL for each individual example. Other rootkit authors also publish research at that you may find useful for keeping up with the latest discoveries.

1. Butler was not interested in rootkits for malicious purposes. He was instead fascinated with the power of kernel modifications. This led Butler to develop one of the first rootkit-detection programs, VICE.

2. Hoglund still wonders, from time to time, whether that original version of FU is still running on his workstation.

3. Userland rootkits are rootkits that do not employ kernel-level modifications, but instead rely only upon user-program modifications.


More About the Authors

Discover books, learn about writers, read author blogs, and more.

Customer Reviews

I would recommend this book to any serious software developer.
Mark W Mitchell
In fact, those who liked the BSD rootkits book would do well to read its Windows counterpart to learn tricks from Hoglund and Butler.
Richard Bejtlich
The code examples are clear and functional, and you'll learn enough to write a basic rootkit in only about 150 pages.

Most Helpful Customer Reviews

55 of 56 people found the following review helpful By jose_monkey_org on August 19, 2005
Format: Paperback
Some may wonder if Hoglund and Butler are being irresponsible by writing a book that shows you how to bypass detection. If you look closely, however, you'll see that all of the methods they outline are detectable by current rootkit revealing mechanisms. And they also show you how to detect many new rootkits in the process. I consider this book to be a responsible contribution to the community, professionals and amateurs alike, in the finest tradition full disclosure.

The book is organized into three major sections, even if it's not explicitly marked as such. The first section serves as an introduction to the topic and some of the high level concepts you'll need to know about Windows, control mechanisms, and where you can introduce your code. The second part is a highly technical tour of the techniques used to hook your rootkit in and hide it, And the third section is really one chapter covering detection of rootkits.

The first few chapters, which serve to introduce the topic, get technical right away. Chapter 2, for example, shows you some basic mechanisms for hooking in your rootkit. If you're getting lost at this point, you'll want to probably augment your reading with a Win32 internals book. The resources listed by the authors, though, are great. By this point you can also see that the writing is clear and the examples contribute perfectly to the topic. Hardware hooking basics are covered in chapter 3, which should give you some indication of the book's pace (quick!).

By the time you get to chapter 4 and discussing how to hook into both userland and the kernel, you're getting at some very valuable material. Although the book focuses on kernel hooking, a brief description of userland hooking is provided.
Read more ›
Comment Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback. If this review is inappropriate, please let us know.
Sorry, we failed to record your vote. Please try again
50 of 56 people found the following review helpful By Stephen Northcutt on August 15, 2005
Format: Paperback
Technical books tend to be either "about things" or "how to do things" with how to being far rarer and generally more valuable. Hoglund and Butler are true authorities on this subject and yet they never brag, instead they focus on helping the rest of us understand what is possible and exactly how it can be done.

Once again, the Addison-Wesley team demonstrates excellence, I found a couple of sentences that could benefit from a rewrite, but no grammar or spelling errors. The charts and code examples are done well and the layout never detracts from the message.

I enjoyed learning about the VICE, patchfinder 2 and Rootkit Revealer tools and can't wait to run them on some of the older laptops in the company that have been used as loaners. I expect that will be revealing!

This was the clearest explanation I have ever seen as to how networking is managed using the Transport Data Inferface. Even so, it still left me just a bit "hungry" and I hope this section is expanded in the second edition of this book.

What impressed me the most though was when the authors reached the limits of their knowledge, after all, this is a developing art and no one understands everything, with areas such as microcode update they simply and frankly stated that.

Clear, pragmatic, authoritative, what's not to like, buy this book.
Comment Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback. If this review is inappropriate, please let us know.
Sorry, we failed to record your vote. Please try again
20 of 21 people found the following review helpful By Charles Hornat - on October 2, 2005
Format: Paperback
A brilliantly written book on everything one would want to know about Rootkits in the Microsoft Windows world. Greg is the industry expert who shares his knowledge through many examples and illustrations that would help almost any level of reader grasp a better understanding of Rootkits.

The authors start with `Understanding Attackers' Motives' and what Rootkits are and aren't, and work they way through Rootkit designs, hardware interaction, hooking into kernel and user, `Direct Kernel Object Manipulation', `Hardware Manipulation', covert techniques and ways to identify Rootkits on your systems.

The authors in-depth knowledge of Rootkits is clearly demonstrated early on when they walk through creating a loadable module, or device/kernel driver. Through this process, they take the time to explain each line, how it manipulates the system, and how it could be used maliciously.

Throughout most of the book, the authors give very detailed examples, lines of code and other evidence supporting the theories and processes presented here. The book is written in a way that they leave little to the imagination and provide hard evidence to support the thought.

The book ends with Rootkit detection, which is the only way to end a book on malicious software. Now that they have taught one how to manipulate and hijack system, here is what one can do to protect the systems they are responsible for, and identify these malicious codes on ones systems. They describe scanning memory, identifying different types of hooks, and again provide some code for one to use to help with these processes.
Read more ›
Comment Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback. If this review is inappropriate, please let us know.
Sorry, we failed to record your vote. Please try again
15 of 16 people found the following review helpful By Thomas Duff HALL OF FAMETOP 1000 REVIEWERVINE VOICE on September 24, 2005
Format: Paperback
I don't think I've ever seen a book as detailed as this on "subverting" an operating system... Rootkits - Subverting The Windows Kernel by Greg Hoglund and James Butler.

Contents: Leave No Trace; Subverting the Kernel; The Hardware Connection; The Age-Old Art of Hooking; Runtime Patching; Layered Drivers; Hardware Manipulation; Covert Channels; Rootkit Detection; Index

Hoglund and Butler have devoted a lot of time to understanding how the Windows kernel works, as well as how rootkits can be utilized to manipulate the kernel. This knowledge led to the website, and subsequently to this book. They explore the definition of rootkits, how they work, and how they can remain hidden from detection. Using the C language, they go into great depth on how rootkit kernel manipulation can be accomplished. If you have a basic knowledge of C, you'll be able to follow along and learn the intricacies of the kernel.

It'd be tempting to wonder why all this dangerous knowledge should be put in book form for junior hackers to use. For one, this isn't script kiddy material. If you don't know how to program (and in C), the book is basically far over your head. I suppose if you were bent towards building your own rootkit for world domination, this material would help. But in reality, this information is probably already accessible to those who would abuse it in the first place. Having a compiled volume of the information helps "the good guys" understand the risks involved as well as how you can protect yourself from rootkit attacks in your own environment.

While programming geeks will likely get the most value from this book, all security experts need to understand the concepts covered here. The worst thing isn't finding out you've been "owned" with a rootkit on your network. It's *not* knowing the rootkit is there...
Comment Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback. If this review is inappropriate, please let us know.
Sorry, we failed to record your vote. Please try again

Most Recent Customer Reviews


What Other Items Do Customers Buy After Viewing This Item?