Rootkits: Subverting the Windows Kernel

Index

[SYMBOL] [A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] [N] [O] [P] [R] [S] [T] [U] [V] [W] [Z]

Scancodes

     in IRPs     mapping Scanning rooms

Scheduling processes

SCM. [See Service Control Manager]

SeAccessCheck function

Segment checks Segment descriptors

Sending     data to remote servers

    packets         in host emulation         with raw sockets     TCP handshakes SendKeyboardCommand function 2nd

SendRaw function

sendto function

Service Control Manager (SCM) 2nd 3rd

ServiceDescriptorEntry structure 2nd

Services key

SetLEDS function

SetPriv function

SetWindowsHookEx function

SGDT instruction

Siberian gas pipeline explosion

SID_AND_ATTRIBUTES structure

SIDs for tokens 2nd

SIDT [See Store Interrupt Descriptor Table]

Signatures, scanning for SizeOfResource function

SMP [See Symmetric MultiProcessing]

SMSS.EXE file

Sniffers, keyboard

Sniffing with raw sockets Socket function Sockets on Windows XP

Software eavesdropping Software exploits Software modifications 2nd Source port forging

Source-code modifications SOURCES file Spinlocks Spyware modifications SSDTs (System Service Dispatch Tables)     finding hooks     hooking

     in rootkit detection

     memory protection for     purpose of 2nd SSPTs (System Service Parameter Tables)

Stack and IRPs 2nd

STATUS BYTE for keyboard ports

Stealth, role of

Steganography     for covert channels 2nd

     on ASCII payloads sti instruction

Store Interrupt Descriptor Table (SIDT) instruction 2nd Storm Watch program Surviving reboots SwapContext function Switches for ARP

Symbolic links

     for fusion rootkits

     in rootkit detection

Symmetric Multi-Processing (SMP) systems

SYN packets 2nd

SYN-ACK packets

Synchronization issues

SYSCALL_INDEX macro

SYSENTER instruction

     for system calls

     for system service dispatcher

     IDT hooks with

SYSTEM LOAD AND CALL IMAGE method

System processSystem Service Descriptor Tables (SSDTs)

     in rootkit detection

     purpose of 2nd

System Service Dispatch Tables (SSDTs)

     finding hooks     hooking     memory protection for

System Service Parameter Tables (SSPTs) SYSTEM_PROCESSES structure SYSTEM_THREADS structure SystemModuleInformation function

SYSTEMSERVICE macro