Buy used:
$33.96
Get Fast, Free Shipping with Amazon Prime
FREE delivery Wednesday, May 15 on orders shipped by Amazon over $35. Order within 13 hrs 26 mins
Used: Like New | Details
Sold by LuxuryMerchandise (Veteran Owned)
Fulfilled by Amazon
Condition: Used: Like New
Comment: Like New- Book has crisp, clean pages without any writing or highlighting throughout. 100% satisfaction guaranteed or your money back. Comes with tracking, 24/7 customer service and free no-hassle returns.

Fulfillment by Amazon (FBA) is a service we offer sellers that lets them store their products in Amazon's fulfillment centers, and we directly pack, ship, and provide customer service for these products. Something we hope you'll especially enjoy: FBA items qualify for FREE Shipping and Amazon Prime.

If you're a seller, Fulfillment by Amazon can help you grow your business. Learn more about the program.

Access codes and supplements are not guaranteed with used items.
Amazon book clubs early access
Loading your book clubs
There was a problem loading your book clubs. Please try again.
Not in a club? Learn more
Amazon book clubs early access

Join or create book clubs

Choose books together

Track your books
Bring your club to Amazon Book Clubs, start a new book club and invite your friends to join, or find a club that’s right for you for free.
Explore Amazon Book Clubs
Kindle app logo image

Download the free Kindle app and start reading Kindle books instantly on your smartphone, tablet, or computer - no Kindle device required.

Read instantly on your browser with Kindle for Web.

Using your mobile phone camera - scan the code below and download the Kindle app.

QR code to download the Kindle App

Follow the authors

Joseph Kong
+ Follow
Joseph Kong
+ Follow
See all
Something went wrong. Please try your request again later.

Designing BSD Rootkits: An Introduction to Kernel Hacking 1st Edition

by Joseph Kong (Author)
4.3 4.3 out of 5 stars 12 ratings
See all formats and editions

Though rootkits have a fairly negative image, they can be used for both good and evil. Designing BSD Rootkits arms you with the knowledge you need to write offensive rootkits, to defend against malicious ones, and to explore the FreeBSD kernel and operating system in the process.

Organized as a tutorial, Designing BSD Rootkits will teach you the fundamentals of programming and developing rootkits under the FreeBSD operating system. Author Joseph Kong's goal is to make you smarter, not to teach you how to write exploits or launch attacks. You'll learn how to maintain root access long after gaining access to a computer and how to hack FreeBSD.

Kongs liberal use of examples assumes no prior kernel-hacking experience but doesn't water down the information. All code is thoroughly described and analyzed, and each chapter contains at least one real-world application.

Included:

  • The fundamentals of FreeBSD kernel module programming
  • Using call hooking to subvert the FreeBSD kernel
  • Directly manipulating the objects the kernel depends upon for its internal record-keeping
  • Patching kernel code resident in main memory; in other words, altering the kernel's logic while it's still running
  • How to defend against the attacks described

    Hack the FreeBSD kernel for yourself!

Read more Read less
Previous page
  1. ISBN-10
    1593271425
  2. ISBN-13
    978-1593271428
  3. Edition
    1st
  4. Publisher
    No Starch Press
  5. Publication date
    April 10, 2007
  6. Language
    English
  7. Dimensions
    7 x 0.5 x 9.25 inches
  8. Print length
    144 pages
  9. See all details
Next page
Amazon First Reads | Editors' picks at exclusive prices

Editorial Reviews

About the Author

Tinkering with computers has always been a primary passion of author Joseph Kong. He is a self-taught programmer who dabbles in information security, operating system theory, reverse engineering, and vulnerability assessment. He has written for Phrack Magazine and was a system administrator for the City of Toronto.

Product details

  • Publisher ‏ : ‎ No Starch Press; 1st edition (April 10, 2007)
  • Language ‏ : ‎ English
  • Paperback ‏ : ‎ 144 pages
  • ISBN-10 ‏ : ‎ 1593271425
  • ISBN-13 ‏ : ‎ 978-1593271428
  • Item Weight ‏ : ‎ 11.2 ounces
  • Dimensions ‏ : ‎ 7 x 0.5 x 9.25 inches
  • Customer Reviews:
    4.3 4.3 out of 5 stars 12 ratings

About the authors

Follow authors to get new release updates, plus improved recommendations.
Previous page
  1. Joseph Kong

    Joseph Kong

    Brief content visible, double tap to read full content.
    Full content visible, double tap to read brief content.

    Joseph Kong is from Toronto, Ontario, Canada. He's worked as a system administrator. His interests include computer (in)security, reverse code engineering, and system programming.

    You can find his website at http://thestackframe.org and on Twitter as @JosephJKong.

    See more on the author's page
  2. Joseph Kong

    Joseph Kong

    Brief content visible, double tap to read full content.
    Full content visible, double tap to read brief content.

    Discover more of the author’s books, see similar authors, read author blogs and more

    See more on the author's page
Next page

Customer reviews

4.3 out of 5 stars
4.3 out of 5
12 global ratings

Top reviews from the United States

AP
5.0 out of 5 stars interesting and fun to read
Reviewed in the United States on August 4, 2016
Great book on this rare topic, easy and fun to read with practical examples.
Helpful
 Report
Brian Bell
4.0 out of 5 stars Why would you use AT&T syntax!?
Reviewed in the United States on July 11, 2016
This would be a 5-star book, if not for the fact that it uses AT&T syntax for ASM. Now, I get that *nix uses AT&T by default, but it is, in my not so humble opinion, stupid. Pretty much any tool you would ever want to use has the option of using Intel syntax, which is much more readable, and easier to understand. Simply put, AT&T syntax is the thing that should not be. Honestly, I don't think I've ever met an ASM dev, reverse engineer, or anyone else who prefers AT&T, and the author's decision to use said syntax seems to me like some kind of twisted torture method, akin to waterboarding a man with orange juice, immediately after he brushes his teeth.

@biebsmalwareguy
5 people found this helpful
Helpful
 Report
Chad Wilson
3.0 out of 5 stars Wrong OS and too old
Reviewed in the United States on March 3, 2015
Verified Purchase
Only about 1/4 through it. So far here are my gripes:

It's based on FreeBSD 6.0 32-bit. No one really uses FreeBSD so why even bother studying rootkits on this platform? As of 2015, this release has long been EOL'ed. Now days, 32-bit is just a bad choice for anything but academic study. But you know this before you buy the book. What you don't know, if like me you have never used BSD, is that BSD is really not that similar to Linux. Yes, it works the same, but all the libs are different. Almost none of the C system libs you would use on Linux exist on FreeBSD. And, if they do, its almost in name only as the API is different.

I believe most of the disappointment comes from my lack of ever using BSD before. Installing it was a PITA and updating it is even more confusing since the system uses both ports and a package system. Writing C in FreeBSD, as mentioned, is also a rude awakening to anyone only familiar with Linux or Windows. Most all the libs you are familiar with are not there. Time to re-learn everything. A chapter dedicated to setting up the OS and environment would have been really nice. A crash course chapter on C programming on BSD would have been nice too.

Finally, the errata page is virtually non-existent. Not a single update for newer releases of the OS or for 64-bit solutions. There is two entries, for typos made in the book. That's all.

The ideas: creating LKM, hooking syscalls, DKOM, kernel patching, etc. are all great academic gems, but since porting this knowledge over to a modern, popular OS is non-trivial, I am going to have to say this book is purely academic. Don't get it if you want something practical.
7 people found this helpful
Helpful
 Report
Nils Valentin
4.0 out of 5 stars Enjoyable primer on system kernel penetration
Reviewed in the United States on May 30, 2007
--- DISCLAIMER: This is a requested review by No Starch Press, however any opinions expressed within the review are my personal ones. ---

This enjoyable readable book gradually and very systematically evolves around hacking the kernel of a BSD system.

Chapter 1: Loadable Kernel Modules 22p.

Chapter 2: Hooking 13p.

Chapter 3: Direct Kernel Object Manipulation 20p.

Chapter 4: Kernel Object Hooking 4p.

Chapter 5: Run-Time Kernel Memory Patching 27p.

Chapter 6: Putting It All Together 26p.

Chapter 7: Detection 8p.

Its written in a style that allows also non-developers to grasp the main procedures and steps involved for modifying a systems kernel (assuming the attacker got access to a privileged system account).

Chapters 1 to 5 explain the several methods for modifying the kernel.

While the book is divided into 7 chapters, its most value really is the Chapters 6 which has many of those WoW effects included.

All or most technics described of chapters 1-5 will be used in chapter 6 for show casing how to circumvent an HIDS. Here is where all learned technics finally come all together.

So the reader dabbles with the author from an initial "simple" idea of bypassing an HIDS from one issue to the next. First the system call is hooked, so technically its kind of working, but then we realize that in order to make it perfect we need to hide the just created file (which contains the execution redirection routine). So the next obvious step is to hide the file so we dont leave a footprint on the system, just to realize that we need to hide the KLD (Dynamic Kernel Linker). So now everything is hidden but we forgot about the change of the /sbin directories access/ modification and change time, so we have to go after that too...

Its technically very interesting to learn how the author approaches the issues involved in order to avoid being detected by the HIDS or commands the user might use. That the author is technically on top of things is also shown f.e. by some info included in the book which is already referring to FreeBSD 7.

To get the most out of the book you ideally have programming knowledge of C, assembly etc. and debugging software systems. So I think its most valuable to system administrators, developers and security consultants.
5 people found this helpful
Helpful
 Report
Ashley
4.0 out of 5 stars Definitely worth a read
Reviewed in the United States on May 29, 2013
This book is a fantastic resource for programmers, FreeBSD enthusiasts and general UNIX hackers.

The book is laid out quite well, with fantastic examples and explanations.
Unfortunately there are a few mistakes in the code examples due to some changes in the FreeBSD code (eg. the sys_ prefix was added to FreeBSD native syscalls )
3 people found this helpful
Helpful
 Report
Anthony Lawrence
4.0 out of 5 stars Fun and informative
Reviewed in the United States on May 16, 2007
I don't do a lot with BSD nowadays.. a lot of software customers want is only for Linux, and although sometimes it could be ported, the customers seem to want Linux. However, I cut my teeth on old SunOS, so bsdisms are familiar and friendly to me.

Working through this book was fun and informative. You can download sources from [....]

The concepts apply equally well to Linux, of course, and I also realized that some of the areas explored come up in ordinary application work and especially in system troubleshooting, so this isn't entirely about subverting systems for evil purpose.
5 people found this helpful
Helpful
 Report

Top reviews from other countries

Translate all reviews to English
Felix J. Ogris
5.0 out of 5 stars sehr gut
Reviewed in Germany on January 26, 2014
Verified Purchase
Ein lesenswertes Buch, wenn man sich ernsthaft mit der Programmierung von Kernelmodulen unter (Free)BSD beschäftigen will. Man sollte sich nicht vom Titel ("...Rootkits") verschrecken lassen. Es geht hier in erster Linie um solide Betriebssystemprogrammierung, an die der Autor den Leser Schritt für Schritt anhand von ausführlichen Beispielen heranführt. Es ist kein Anfängerbuch. Man sollte schon ein wenig Ahnung von BSD und Programmieren mitbringen.
One person found this helpful
 Report
Honest Reviewer
4.0 out of 5 stars An intensive introduction to kernel hacking
Reviewed in the United Kingdom on February 28, 2009
Verified Purchase
A rootkit is a set of code that basically allows someone to control certain aspects of the operating system; and the two goals of the book are to expose readers to rootkit writing, and to provide them with an insight into the FreeBSD kernel. Before you attempt this you will need to be au fait with the C programming language - there is no crash-course chapter. This short book has 7 chapters consisting in large parts of program code, many of whose lines are individually explained. Most people would like to test the code for themselves without typing it all; thankfully, it is download-able from the Nostarch website.
One person found this helpful
 Report