Designing BSD Rootkits

What Hacker News says

1. beeburrtSep 2023
   Maybe Joseph Kong's books?

   Designing BSD Rootkits

   https://nostarch.com/rootkits.htm

   FreeBSD Device Drivers

   https://nostarch.com/bsddrivers.htm

   Playing Games With Kernel Memory ... FreeBSD Style

   http://phrack.org/issues/63/7.html#article

   Show morethread
2. ninjinSep 2022
   “Linux” indeed… I know for a fact that Absolute OpenBSD, The Book of PF, and Designing BSD Rootkits are great. Tempted to pick up the bundle to read FreeBSD Device Drivers, The Book of GIMP, Absolute FreeBSD, and The Book of Inkscape.
   thread
3. vezzy-fnordNov 2014
   This module appears to use a simple brute force method for uncovering the address of the system call table, as opposed to hardcoding from System.map. There's another more elegant solution that could be of interest to readers: http://www.elliotbradbury.com/linux-syscall-hooking-interrup...

   If you're looking for deeper case studies on Linux rootkits, the Suterusu rootkit is an interesting PoC: http://poppopret.org/2013/01/07/suterusu-rootkit-inline-kern...

   On the other hand, if you're looking for a guide on understanding LKMs from the ground up and how they can apply to rootkits, I strongly recommend Joseph Kong's excellent book Designing BSD Rootkits. It's FreeBSD-specific and dates to 2007, but it's not still outdated AFAIR: http://www.nostarch.com/rootkits.htm

   Show morethread
4. kryptisktFeb 2014
   There is even a book about designing FreeBSD rootkits: http://www.amazon.com/Designing-BSD-Rootkits-Introduction-Ha...
   thread
5. ZephyrPFeb 2012
   I spent a considerable portion of my teenage years wasting away in front of books like Windows Internals in the hopes that I would be slightly better at writing rootkits and exploits than the next guy. It's a pretty fulfilling skill and meeting someone with real (I stress real) deep kernel knowledge basically never happens, which can give you a reputation for solving the unsolvable, which is both positive and negative. As you may have surmised however, it's effectively commercially useless to have reverse engineering, assembly or kernel mode driver development skills -- That considered, I'd highly recommend you give it a shot, 'Understanding the Linux Kernel' and 'Windows Internals' are some of my favorite technical books. If you have only a rudimentary understanding of memory paging and assembly, I'd recommend 'Reversing: The Art of Reverse Engineering' and 'The art of exploitation' both published by No Starch (Which also publishes two highly recommended, but certainly not my favorite - "Designing BSD Rootkits" and "Art of Assembly").

   Best of luck!

   Show morethread
6. tptacekAug 2010
   It's not amazing. It benefits Matasano more than it benefits any individual team members. It would be ridiculous not to have the policy; people would deliver crappier work for clients and waste everyone's time bugging us for books. In the worst case, one of the managers might get a bug up their ass and start thinking about what books people should get; calamity!

   There are a very few conditions:

   ## Terms and Conditions

   ### Limits

   This benefit includes no stated specific limit on the number of books you can acquire or the subject matter they involve. We'd like to keep the policy as simple as possible. Our only request is: please intend to read or use whichever books you acquire. If you think you'll want a book on Clojure programming 6 months from now, consider waiting a couple months before getting it.

   ### Multiple Copies

   Please do not obtain more than one copy of the same title, unless you've lost or somehow destroyed your first copy.

   ### Ownership and Sharing

   When you get a book under this benefit, it's your book. It belongs to you.

   At the same time, we hope books acquired under this benefit will help build an office library. If you're not using a book, please give it a home in the office library.

   We'll provide a wiki page to register what books are available in the library, so you can easily tell whether you should look for a title in the office or go ahead and order it.

   If you know the library has a copy of something you want, please use the library copy until you're sure you need to own your own copy. We are not asking everyone to share a single copy of the IDA Pro book, but we also don't want to buy 10 copies of "Designing BSD Rootkits".

   ### Crazy Ridiculous Books

   Please do not use this benefit to try to acquire collector copies of first-edition signed Knuth prints that cost $1000, or, for that matter, to acquire professional books (like ANSI standards) that cost hundreds of dollars. If you need a book that costs hundreds of dollars, use "How Do I Get Books" option 3 and talk to Cory or Dave; we'll figure something out.

   ---

   Nothing in there says you can't use this policy to buy Denis Johnson's _Tree of Smoke_ to read on the train. Nobody has, but if someone did I'd probably just smile.

   Show morethread