How to start Rootkit

How about a rootkit FAQ for the forums?
By: Clandestiny

Help! I’m a newbie! I need a rootkit to hack my friend’s box… I want to write my own rootkit… I want to start exploiting code… Where do I start?”

These type of questions appear repeatedly on rootkit.com and rather than re-inventing the wheel every time someone asks one of these questions, it occurred to me that we could compile a short document to generically address them. The following discussion is by no means complete, but it can be expanded based upon the suggestions of experienced individuals in the community.

I am also placing a copy in .pdf format in my fault. 


FAQ - Where Do I Start?

So you want to know where to start? Well, first off, if you’ve come here looking for a ready-made solution to hack your friend’s box, you’ve come to the wrong place! Rootkit.com is primarily a knowledge based site intended to provide information about rootkit development and related programming issues. On the other hand, if you’re a newbie with a desire to learn how to write your own rootkit and you need some idea of where to begin, please read on… 

Unfortunately, rootkit development and software exploitation have a rather long list of pre-requisite knowledge that must be acquired.

1. First, you must learn a programming language. C / C++ is the preferred choice. Unlike many other languages, C has the capability of supporting inline assembly language. Although most programmers have little use for assembly, rootkit development occasionally requires this flexibility and x86 assembly should be your second programming language. The Art Of Assembly by Randall Hyde is one of the best references on this subject. It is available both in print and in electronic format (free!). 

Art of Assembly (downloadable version) http://webster.cs.ucr.edu/AoA/DOS/

2. You need to learn a little theory about operating systems. Although a graduate course in theoretical operating system design is not required, reading a few chapters in any undergraduate computer science textbook will help. Specifically, you need to understand processes, threads, and memory management.

Three decent books on the subject:
a. Operating System Concepts by Silberschatz, Galvin, and Gagne
b. Operating Systems by Deitel & Deitel
c. Inside Microsoft Windows 2000 by Solomon and Russinovich is an excellent read. It applies OS theory to Microsoft's implementation.

3. You need to apply the theory to understanding how a real world operating system like Windows actually works. Although Windows is closed-source, there are a number of smart individuals who have spent time reversing it’s internal workings and publishing their findings. Get a book like:
a. Undocumented Windows 2000 Secrets by Sven Schreiber
b. Undocumented Windows NT by Prasad Dabak, Milind Borate, and Sandeep Phadke.
c. Windows NT/2000 Native API Reference by Gary Nebbett is a must have!

4. If you want to get into kernel rootkits, you will also need to learn how to write a kernel mode driver (KMD). Unfortunately, there are very few beginner tutorials available online with regard to kernel programming. Four-4, however, does have several excellent win32 assembly tutorials which can be found at: http://www.assembly-journal.com/sitemap.php
Additionally, there are quite a few books on the subject including: 
a. The Windows 2000 Device Driver Book by Art Baker and Jerry Lozano 
b. Windows NT Device Driver Development by Viscarola and Mason
c. Programming The Microsoft Windows Driver Model by Walter Oney. 
d. Developing Windows NT Device Drivers: A Programmer's Handbook by Dekker and Newcomer (The Bible of reference materials)

5. You need to learn the basics of “reversing” code, that is to say gaining an understanding of a binary for which you don’t have any source code. A fun way to develop these skills is to practice reversing software protections (serials, time trials, unpacking, demo-cripple-ware, ect). Many programmers have written small “training” training programs called “crackmes” and “reversemes” which can also be used for practice. A large collection of them can be found at http://www.crackmes.de and http://www.reversemes.de A great resource of knowledgeable people for reverse code engineering is http://www.woodmann.com . Also, http://bib.universitas-virtualis.org/ has some good tutorials and papers. Reversing also requires some specialized tools including a disassembler and a debugger. IDA Pro is preferred for disassembly while either Soft ICE (kernel debugging) or OllyDebug will work as a debugger. Miscellaneous reversing related tools can be found at http://protools.cjb.net .

6. Finally, if you need resources to get started understanding some of the vulnerabilities and rootkits discussed on this site. I would recommend both Exploiting Software by Greg Hoglund (one of the guys that runs this site and the Shell Coder's Handbook. Both of these will give you a good introduction. Exploiting Software also has a chapter explaining basic rootkit techniques. Rootkits can, in general, be divided into 2 categories based upon their method of data interception: that is either hooking or direct kernel object manipulation (DKOM). For understanding hooking techniques, the following links to articles may be useful.

API Spying Techniques 
http://www.internals.com/articles/apispy/apispy.htm

Advanced Function Hooking
http://www.phrack.org/show.php?p=58&a=8

Windows NT Service Table Hooking
http://www.wiretapped.net/~fyre/sst.html

Hooking Windows NT System Services
http://www.windowsitlibrary.com/Content/356/06/2.html

Windows NT System-Call Hooking 
http://www.ddj.com/articles/1997/9701/

For understanding DKOM, you should look at the source for FU rookit here on this site written by fuzen_op.

原文地址：http://www.rootkit.com/newsread.php?newsid=182

文章的英文意思很简单，仔细看一下就能明白了。

1.c/c++ -->2.asm -->3. theory about operating systems -->4.native api -->5.KMD-->6.reversing

文章大概就是上面说的那些，1和2就不说了，从3开始吧。

把老罗的那本书一看，应该对进程,线程，PE的理解应该有一个认识了，对操作系统的认识绝对比一般理论介绍的书要深刻很多。

可以看看jeffery richter的《windows核心编程》，中文版的也到第五版来了，通过这本书熟悉对ring3的操作，包括文件、进程、注册表，事件、信号量等等。

文章推荐的《undocument windows NT》很值得一看，有中文版，是董岩翻译的，csdn上有。

这本书，主要从Memory manage，reserving engineering，hook等方面介绍windows NT构架，能让我们大体熟悉NT构架。

文章所说的，Windows NT/2000 Native API Reference 中文译名叫《windowsNT/2000本机API参考手册》见http://www.china-pub.com/4015。

文章推荐的Inside Microsoft Windows 2000 ,现在已经出到第五版了。中文版，到第四版，潘爱民先生翻译的，《深入解析windows操作系统》，放在3来看，可能有点吃力，放在这个位置看，可能更加合适。

关于windows驱动设计的，除了文章推荐的那些，国内的《windows驱动开发详解》和《windows内核安全编程》也是很值得一看，具体资料还是参考下 驱网和第八个男人吧。

至于关于reserving的学习，不必放在第六的位置，可以穿插整个学习过程，看雪的出的书，和《逆向工程揭密》多很值得一看。

自己也Mark一下，不少东西，以后还能用得着，

努力学习windows kernel。。。