The Rootkit Arsenal: Escape and Evasion in the Dark Corners of the System (Paperback)

~ (Author)

Editorial Reviews

Product Description

With the growing prevalence of the Internet, rootkit technology has taken center stage in the battle between White Hats and Black Hats. Adopting an approach that favors full disclosure, The Rootkit Arsenal presents the most accessible, timely, and complete coverage of rootkit technology. This book covers more topics, in greater depth, than any other currently available. In doing so, the author forges through the murky back alleys of the Internet, shedding light on material that has traditionally been poorly documented, partially documented, or intentionally undocumented.

Product Details

• Paperback: 908 pages
• Publisher: Jones & Bartlett Publishers; 1 edition (May 4, 2009)
• Language: English
• ISBN-10: 1598220616
• ISBN-13: 978-1598220612
• Product Dimensions: 9 x 6 x 2 inches
• Shipping Weight: 2.7 pounds (View shipping rates and policies)
• Average Customer Review: 4.7 out of 5 stars  See all reviews (6 customer reviews)
• Amazon.com Sales Rank: #33,996 in Books (See Bestsellers in Books)

  Popular in these categories: (What's this?)

  #8 in	Books > Computers & Internet > Business & Culture > Security
  #12 in	Books > Computers & Internet > Business & Culture > Hacking

Customer Reviews

Most Helpful Customer Reviews

9 of 9 people found the following review helpful:

5.0 out of 5 stars Awesome gigantic compilation on Rootkits, August 16, 2009

By	Nagareshwar Talekar (Bangalore, India) - See all my reviews

The Rootkit Arsenal: Escape and Evasion in the Dark Corners of the System

Wow...! This was my first reaction when I received this massive 900+ pages book from Amazon. I was just spell bounded and surprised to see such an enormous amount of information compiled on the lesser known area of computer security, the Rootkits.

The book starts with basics of system internals which is essential to understand the depth of Rootkits. It covers about various memory models, interrupts, TSR, Windows architecture etc in detail. Then it delves into explaining the ingredients of Rootkit including installing and launching of the Rootkit. All these system internals have been covered in very precise and concise manner.

The chapter 5 is where the real fun starts as it goes on elaborating all the hooking mechanisms from user land to kernel and then it describes various techniques for detecting these hooking mechanisms. Later chapters does awesome job of explaining the advanced Rootkit techniques. The Anti-Forensics section is just mind blowing, no explanation needed.

One of the salient features of this book is the code samples. Every technique mentioned in this book is illustrated with well explained, working code example. This along with Rootkit detection mechanisms explored in the book sets it apart from its predecessor, Rootkit - Subverting Windows Kernel.

Its clearly evident that author has taken great pain and patience to present the darkest topic of computer arena in a very simple and understandable manner in this gigantic compilation. By far this is the very good reference book and very well recommended for any one who wants to conquer the mysterious world of Rootkits.

7 of 7 people found the following review helpful:

5.0 out of 5 stars Whoa!, August 10, 2009

By	Hugh K. Boyd (Fayetteville, GA) - See all my reviews (REAL NAME)

Man! This thing is dangerous! The first couple of chapters provide probably one of the best overviews I've seen on the topics of IA86 and Win32 architecture. Then we get into the meat of the techniques for building rootkits. Finally, the author goes into anti-forensics. It's about as deep a dive into the subject as you'll find anywhere with examples that demonstrate how to use rootkits to pull off privilege escalation exploits, subverting group policy, hiding applications, and drivers, etc, etc. After the tutorial chapters, there are gobs and gobs of code (I only wish that it were on CD or downloadable -- but you actually learn from entering and building it). Be forewarned: the code really works!

6 of 6 people found the following review helpful:

5.0 out of 5 stars More than just a rootkit book, August 18, 2009

By	J. Clark - See all my reviews (REAL NAME)

You cannot become an expert at developing Windows Rootkits without first gaining a thorough understanding of Intel system architecture, Windows architecture and the Windows Driver Model. This book provides some of the best coverage I've seen of those topics, in addition to providing a VERY complete coverage of rootkit development.