Rootkits: Subverting the Windows Kernel

Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in this book, and the publisher was aware of a trademark claim, the designations have been printed with initial capital letters or in all capitals.

The authors and publisher have taken care in the preparation of this book, but make no expressed or implied warranty of any kind and assume no responsibility for errors or omissions. No liability is assumed for incidental or consequential damages in connection with or arising out of the use of the information or programs contained herein.

The publisher offers excellent discounts on this book when ordered in quantity for bulk purchases or special sales, which may include electronic versions and/or custom covers and content particular to your business, training goals, marketing focus, and branding interests. For more information, please contact:

    U.S. Corporate and Government Sales    (800) 382-3419

    corpsales@pearsontechgroup.com

For sales outside the U.S., please contact:

          International Sales

          international@pearsoned.com

Visit us on the Web: www.awprofessional.comLibrary of Congress Cataloging-in-Publication DataHoglund, Greg.Rootkits: subverting the Windows kernel / Greg Hoglund, James Butler.

       p. cm.

  Includes bibliographical references and index.

  ISBN 0-321-29431-9 (pbk. : alk. paper)

 1. Microsoft Windows (Computer file) 2. Computers Access control. 3. Computer security.

I. Butler, James. II. Title.

QA76.9.A25H637 2005

  005.8 dc22                                                                                                     2005013061

Copyright © 2006 Pearson Education, Inc.

All rights reserved. Printed in the United States of America. This publication is protected by copyright, and permission must be obtained from the publisher prior to any prohibited reproduction, storage in a retrieval system, or transmission in any form or by any means electronic, mechanical, photocopying, recording, or likewise. For information regarding permissions, write to:

Pearson Education, Inc.

Rights and Contracts Department

One Lake Street

Upper Saddle River, NJ 07458

Text printed in the United States on recycled paper at Courier in Stoughton, Massachusetts. First printing, July 2005

Dedication

Dedicated to all the contributors at rootkit.com, and to all who share knowledge without fear.

Greg

To my parents, Jim and Linda, for their many years of selfless sacrifice.

Jamie