• RRP: £40.99
  • You Save: £6.15 (15%)
FREE Delivery in the UK.
In stock.
Dispatched from and sold by Amazon. Gift-wrap available.
Rootkits: Subverting the ... has been added to your Basket
+ £2.80 UK delivery
Used: Very Good | Details
Condition: Used: Very Good
Comment: This book is in very good condition and will be shipped within 24 hours of ordering. The cover may have some limited signs of wear but the pages are clean, intact and the spine remains undamaged. This book has clearly been well maintained and looked after thus far. Money back guarantee if you are not satisfied. See more of our deals.
Have one to sell?
Flip to back Flip to front
Listen Playing... Paused   You're listening to a sample of the Audible audio edition.
Learn more
See all 3 images

Rootkits: Subverting the Windows Kernel (Addison-Wesley Software Security) Paperback – 22 Jul 2005

4.5 out of 5 stars 4 customer reviews

See all formats and editions Hide other formats and editions
Amazon Price
New from Used from
Kindle Edition
"Please retry"
"Please retry"
£30.03 £2.29
Note: This item is eligible for click and collect. Details
Pick up your parcel at a time and place that suits you.
  • Choose from over 13,000 locations across the UK
  • Prime members get unlimited deliveries at no additional cost
How to order to an Amazon Pickup Location?
  1. Find your preferred location and add it to your address book
  2. Dispatch to this address when you check out
Learn more

Top Deals in Books
See the latest top deals in Books. Shop now
£34.84 FREE Delivery in the UK. In stock. Dispatched from and sold by Amazon. Gift-wrap available.
click to open popover

Frequently Bought Together

  • Rootkits: Subverting the Windows Kernel (Addison-Wesley Software Security)
  • +
  • The Code Book: The Secret History of Codes and Code-breaking
Total price: £42.53
Buy the selected items together

Enter your mobile number or email address below and we'll send you a link to download the free Kindle App. Then you can start reading Kindle books on your smartphone, tablet, or computer - no Kindle device required.

  • Apple
  • Android
  • Windows Phone

To get the free app, enter your mobile phone number.

Top Deals in Books
See the latest top deals in Books. Shop now

Product details

  • Paperback: 352 pages
  • Publisher: AddisonWesley Professional; 01 edition (22 July 2005)
  • Language: English
  • ISBN-10: 0321294319
  • ISBN-13: 978-0321294319
  • Product Dimensions: 17.5 x 2.3 x 23.1 cm
  • Average Customer Review: 4.5 out of 5 stars  See all reviews (4 customer reviews)
  • Amazon Bestsellers Rank: 537,651 in Books (See Top 100 in Books)
  • See Complete Table of Contents

Product Description

From the Back Cover

"It's imperative that everybody working in the field of cyber-security read this book to understand the growing threat of rootkits."
--Mark Russinovich, editor, Windows IT Pro / Windows & .NET Magazine

"This material is not only up-to-date, it defines up-to-date. It is truly cutting-edge. As the only book on the subject, Rootkits will be of interest to any Windows security researcher or security programmer. It's detailed, well researched and the technical information is excellent. The level of technical detail, research, and time invested in developing relevant examples is impressive. In one word: Outstanding."
--Tony Bautts, Security Consultant; CEO, Xtivix, Inc.

"This book is an essential read for anyone responsible for Windows security. Security professionals, Windows system administrators, and programmers in general will want to understand the techniques used by rootkit authors. At a time when many IT and security professionals are still worrying about the latest e-mail virus or how to get all of this month's security patches installed, Mr. Hoglund and Mr. Butler open your eyes to some of the most stealthy and significant threats to the Windows operating system. Only by understanding these offensive techniques can you properly defend the networks and systems for which you are responsible."
--Jennifer Kolde, Security Consultant, Author, and Instructor

"What's worse than being owned? Not knowing it. Find out what it means to be owned by reading Hoglund and Butler's first-of-a-kind book on rootkits. At the apex the malicious hacker toolset--which includes decompilers, disassemblers, fault-injection engines, kernel debuggers, payload collections, coverage tools, and flow analysis tools--is the rootkit. Beginning where Exploiting Software left off, this book shows how attackers hide in plain sight.

"Rootkits are extremely powerful and are the next wave of attack technology. Like other types of malicious code, rootkits thrive on stealthiness. They hide away from standard system observers, employing hooks, trampolines, and patches to get their work done. Sophisticated rootkits run in such a way that other programs that usually monitor machine behavior can't easily detect them. A rootkit thus provides insider access only to people who know that it is running and available to accept commands. Kernel rootkits can hide files and running processes to provide a backdoor into the target machine.

"Understanding the ultimate attacker's tool provides an important motivator for those of us trying to defend systems. No authors are better suited to give you a detailed hands-on understanding of rootkits than Hoglund and Butler. Better to own this book than to be owned."
--Gary McGraw, Ph.D., CTO, Cigital, coauthor of Exploiting Software (2004) and Building Secure Software (2002), both from Addison-Wesley

"Greg and Jamie are unquestionably the go-to experts when it comes to subverting the Windows API and creating rootkits. These two masters come together to pierce the veil of mystery surrounding rootkits, bringing this information out of the shadows. Anyone even remotely interested in security for Windows systems, including forensic analysis, should include this book very high on their must-read list."
--Harlan Carvey, author of Windows Forensics and Incident Recovery (Addison-Wesley, 2005)

Rootkits are the ultimate backdoor, giving hackers ongoing and virtually undetectable access to the systems they exploit. Now, two of the world's leading experts have written the first comprehensive guide to rootkits: what they are, how they work, how to build them, and how to detect them. Rootkit.com's Greg Hoglund and James Butler created and teach Black Hat's legendary course in rootkits. In this book, they reveal never-before-told offensive aspects of rootkit technology--learn how attackers can get in and stay in for years, without detection.

Hoglund and Butler show exactly how to subvert the Windows XP and Windows 2000 kernels, teaching concepts that are easily applied to virtually any modern operating system, from Windows Server 2003 to Linux and UNIX. Using extensive downloadable examples, they teach rootkit programming techniques that can be used for a wide range of software, from white hat security tools to operating system drivers and debuggers.

After reading this book, readers will be able to

  • Understand the role of rootkits in remote command/control and software eavesdropping
  • Build kernel rootkits that can make processes, files, and directories invisible
  • Master key rootkit programming techniques, including hooking, runtime patching, and directly manipulating kernel objects
  • Work with layered drivers to implement keyboard sniffers and file filters
  • Detect rootkits and build host-based intrusion prevention software that resists rootkit attacks

Visit rootkit.com for code and programs from this book. The site also contains enhancements to the book's text, such as up-to-the-minute information on rootkits available nowhere else.

About the Author

Greg Hoglund has been a pioneer in the area of software security. He is CEO of HBGary, Inc., a leading provider of software security verification services. After writing one of the first network vulnerability scanners (installed in over half of all Fortune 500 companies), he created and documented the first Windows NT-based rootkit, founding rootkit.com in the process. Greg is a frequent speaker at Black Hat, RSA, and other security conferences.

James Butler, Director of Engineering at HBGary, has a world-class talent for kernel programming and rootkit development and extensive experience in host-based intrusion-detection systems. He is the developer of VICE, a rootkit detection and forensics system. Jamie's previous positions include Senior Security Software Engineer at Enterasys and Computer Scientist at the National Security Agency. He is a frequent trainer and speaker at Black Hat security conferences. He holds a masters of computer science from the University of Maryland, Baltimore County. He has published articles in the IEEE Information Assurance Workshop, Phrack, USENIX ;login:, and Information Management and Computer Security.

Customer Reviews

4.5 out of 5 stars
5 star
4 star
3 star
2 star
1 star
See all 4 customer reviews
Share your thoughts with other customers

Top Customer Reviews

Format: Paperback Verified Purchase
Rootkits are defined as a set of programs and code that allows a permanent or consistent, undetectable presence on a computer. The "root" denotes the all powerful superuser in the UNIX systems. Though no such account exists in windows the use rootkit applies to a piece of code that resides in the machine , which is generally undetectable and allows the owner of the code to have administrative rights on the windows machine on which it is running.
Rootkits have been in prominence in the recent past due to the Sony's infamous DRM. Apparently that could be described as "benevolent" use of rootkits. This is one of the many first books to come on in the recent past. The knowledge of rootkits were not available to general public till recently. The book describes in detail the different classes of rootkits that could be found in windows operating system and their mechanism of operation. There still exists a vacuum of a book on rootkit in Unix operating systems. Rootkits were known to be more prevalent in Unix versions than windows systems. The book describes in detail the mechanisms of action of rootkits and does describe briefly the methods for detection of rootkits.
The book has been an end result of the authors long interest in rootkits, the author has setup a website and forum named rootkit which bears the same name. The book looks at the possible ways of subverting the operating system. This includes looking at both the software and hardware methods that could be used. It also looks at the possible methods of detection and describes them in lesser details. Each of methods of subverting the operating is described in detail with sample pieces of code.
Read more ›
Comment 25 people found this helpful. Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback.
Sorry, we failed to record your vote. Please try again
Report abuse
Format: Kindle Edition Verified Purchase
The content is good, but it's a tough read. Even if you're experienced with Windows development and techniques that are used in the book, it's not an enjoyable read but more of a heavy slog. Many more texts are making infosec topics more approachable,. To be very honest I'd rather spend time with Windows Internals than this book, but that said it's a quality source on the subject topic hence the 4 stars.
Comment Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback.
Sorry, we failed to record your vote. Please try again
Report abuse
Format: Paperback Verified Purchase
Great read, if your looking some in depth technical content read to stimulate the mind this will do it.
Comment Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback.
Sorry, we failed to record your vote. Please try again
Report abuse
Format: Paperback
all good
Comment Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback.
Sorry, we failed to record your vote. Please try again
Report abuse

Most Helpful Customer Reviews on Amazon.com (beta)

Amazon.com: 4.1 out of 5 stars 28 reviews
4 of 10 people found the following review helpful
2.0 out of 5 stars Missing something. My guess a fluent thought. Sparatic, and Suggestive at best... 16 May 2011
By edmin - Published on Amazon.com
Format: Paperback Verified Purchase
Nice cover. Not recommended. Poorly written. Reads like a gamer wrote it, not a professional programmer. Neato ideas with a lot of fluff, no substance.
1 of 1 people found the following review helpful
4.0 out of 5 stars A very insightful book into the workings of Malware 12 Nov. 2012
By Andrey Norin - Published on Amazon.com
Format: Paperback
I had read this book with the intentions of gaining a better understanding how advanced malware works on the Windows OS. Coupled with Windows Internals, this book has given me a better knowledge of how deal with malware outbreaks at my job. This book provides you with code to build your own rudimentary rootkit, kind of a rootkit "Hello World" program. This book was published in 2005, so the rootkit design would be pre-Vista/Win7. Going from XP to Vista/Win7 represents a quantum leap in terms of resistance to malware, as a large number of security mechanisms were introduced since then, so I doubt the rootkit code would hold water today.

However, this book is still a good read for a Windows administrator who wants to know how to better deal with malware outbreaks, and in gauging the potential impact on the enterprise.

As for practical application; this book has helped me understand the analysis of a ZeroAccess persistent rootkit, something that I had been dealing with at work.

9 of 9 people found the following review helpful
4.0 out of 5 stars The definitive text on Windows rootkits, applicable in 2005 or 2007 23 Jun. 2007
By Richard Bejtlich - Published on Amazon.com
Format: Paperback
I read Rootkits: Subverting the Windows Kernel last year, but waited until I read Joseph Kong's Designing BSD Rootkits before reviewing both books. In a head-to-head comparison, I thought Kong's book was easier to comprehend and directly covered the key techniques I wanted to see. If I could give this book 4 1/2 stars I would, but Amazon doesn't allow that luxury.

Hoglund and Butler should be commended for writing this book. It really does assemble the parts (meaning techniques and code) necessary to implement a Windows rootkit, at least prior to Windows Vista. My only concern is that, at times, the authors are not as clear as I hoped they might be. This is probably due to the fact that they are two of the best rootkit writers on the planet, so they probably do not remember what it was like to not understand "hooking" and other techniques.

In some ways Rootkits is probably a book best suited for other experts (like many who wrote reviews here). That leaves beginners (like myself) wishing for a little more foundation or direct language prior to reading about implementation tricks.

One of the greatest strengths of this book, however, is the degree to which it exposes the internal workings of Windows. For greatest effect it's probably worth reading Microsoft Windows Internals, Fourth Edition by Russinovich and Solomon first.

Note that although I found the direct approach of the BSD rootkits book better for my learning style, this book by Hoglund and Butler is deeper in several areas. In fact, those who liked the BSD rootkits book would do well to read its Windows counterpart to learn tricks from Hoglund and Butler.
60 of 62 people found the following review helpful
5.0 out of 5 stars be an elite hacker d00d! 20 Aug. 2005
By jose_monkey_org - Published on Amazon.com
Format: Paperback
Some may wonder if Hoglund and Butler are being irresponsible by writing a book that shows you how to bypass detection. If you look closely, however, you'll see that all of the methods they outline are detectable by current rootkit revealing mechanisms. And they also show you how to detect many new rootkits in the process. I consider this book to be a responsible contribution to the community, professionals and amateurs alike, in the finest tradition full disclosure.

The book is organized into three major sections, even if it's not explicitly marked as such. The first section serves as an introduction to the topic and some of the high level concepts you'll need to know about Windows, control mechanisms, and where you can introduce your code. The second part is a highly technical tour of the techniques used to hook your rootkit in and hide it, And the third section is really one chapter covering detection of rootkits.

The first few chapters, which serve to introduce the topic, get technical right away. Chapter 2, for example, shows you some basic mechanisms for hooking in your rootkit. If you're getting lost at this point, you'll want to probably augment your reading with a Win32 internals book. The resources listed by the authors, though, are great. By this point you can also see that the writing is clear and the examples contribute perfectly to the topic. Hardware hooking basics are covered in chapter 3, which should give you some indication of the book's pace (quick!).

By the time you get to chapter 4 and discussing how to hook into both userland and the kernel, you're getting at some very valuable material. Although the book focuses on kernel hooking, a brief description of userland hooking is provided. Chapter 5 covers runtime patching, a black art that's not well known. This is almost worth the full price of admission, but the material gets even better.

In chapters 6-9 you get into some serious deep voodoo and dark arts. In these chapters you'll learn the basics of direct kernel object manipulation, layered device drivers (which can save you a lot of work), hardware manipulation, and network handling. All of these are techniques used by rootkit authors to varying degrees and effect, so you should become familiar with them. The code examples are clear and functional, and you'll learn enough to write a basic rootkit in only about 150 pages. Simple keyboard sniffers and covert channels are described in the code examples. Useful stuff.

I can't say I found many errors or nits in the book. There's some problems at times getting the code formatting just right, and what appear to be a few stray characters here and there, but nothing too obvious to me. Then again, I'm not a Windows kernel programmer, so I don't feel qualified to comment on the correctness of the code.

In the finest tradition of using a blog and dynamic website to assist your readers, the authors have set up rootkit.com, which nicely supplements their book. Most of the resources they mention in the book are available here, as well as a great array of contributors and evolving techniques. Without the book the site is still useful, but together they're a great combination. Too many books lose their value once you read them, and some books stay with you because you're having difficulty understanding the authors. Rootkits will stay near you while you develop your skills because it's a lot of material in a small space, and although it's very clearly written, there is a deep amount of material to digest. You'll be working with this one for a while.

My only major wish for this book is for it to have covered detection more significantly. One chapter covers how to detect rootkits, and although you may be able to look for some specific telltale signs of rootkits depending on how they were introduced, a more complete coverage of this approach would have made the book even more worthwhile.

Rootkits is an invaluable contribution in the wider understanding of advanced attack and hacker techniques. Previously, much of this material was known to only a handful of people, and assembling your own knowledge base was difficult. Hoglund and Butler write clearly, use great code examples, and deliver an excellent book on a high technical and specialized topic. If you're interested in learning how to write your own rootkit or detect someone else's rootkit on your system, you should definitely start with this book.
7 of 7 people found the following review helpful
5.0 out of 5 stars Compiles all of the state-of-the-art knowledge on Rootkits 11 Aug. 2005
By Michael Myers - Published on Amazon.com
Format: Paperback
Rootkits are a hot topic in Windows security this year. You cannot go to a computer security conference anymore without at least two talks on the topic, either about improving the ways to subvert the operating system or about the newest methods for detecting this behavior. The research on both sides is a fast-changing body of knowledge. Butler and Hoglund's book captures the state-of-the-art in this field. The information is very fresh, and delivers thorough coverage on what's out there to date.

Kernel programming -- and more specifically, hacking the undocumented internals of a closed source OS's kernel -- is one of the most challenging tasks in programming. The authors handle this well, walking the fine line between assuming too much of their reader and wasting time on fundamental concepts. The intended audience will have good knowledge of Intel x86 architecture and experience with C programming. But, if this is your first experience with rootkits, the book is an excellent resource and will get you up to speed. Likewise, if you have already experimented with rootkits of your own, this book is the perfect reference material. Indeed it's the only book that has yet been written on the topic.

As computer security gains in importance, skills that were previously black arts (reverse engineering, disassembling, shellcode authoring, kernel hacking, etc) are finally moving above-ground, and I think this is a good thing. This book is part of that movement.

This book should have broad appeal. I recommend it to device driver developers, blackhat hackers that need to cover their tracks, security researchers, and anyone wanting a better understanding of the Windows kernel.
Were these reviews helpful? Let us know