Professional Rootkits (Programmer to Programmer)

Overview

Up until now, the hooks and filters we’ve created have done little more than monitor or block traffic. This chapter introduces logging as another processing option. Unfortunately, file system operations (logging) require a passive processing level, while the keyboard monitor we create in this chapter can run at the dispatch processing level. Because file operations running at the dispatch level will cause the operating system to crash, a thread, a data storage medium, and a synchronization method must be implemented to guarantee proper operation.

This chapter covers the following:

• Processing levels

• A keyboard filter

• Threading and synchronization

• Interpreting key codes

• An example

• Testing the example