Saturday, April 24, 2010

Review of The Rootkit Arsenal Posted

Amazon.com just posted my five star review of The Rootkit Arsenal by Bill Blunden. I received this book last year but didn't get a chance to finish it until this week, thanks to several long plane flights. From the review:

Disclaimer: Bill mentions me and my book "Real Digital Forensics" on pages xxvi and 493. He sent me a free review copy of his book.

"Wow." That summarizes my review of "The Rootkit Arsenal" (TRA) by Bill Blunden. If you're a security person and you plan to read one seriously technical book this year, make it TRA. If you decide to really focus your attention, and try the examples in the book, you will be able to write Windows rootkits. Even without taking a hands-on approach, you will learn why you can't trust computers to defend themselves or report their condition in a trustworthy manner.

3 comments:

Wesley McGrew said...

Couldn't agree more on this book. I've recommended it to several folks. Even if you're not interested in rootkits, it has one of the best descriptions of low-level x86 workings that I've read. That, and you'll be interested in rootkits by the time it's over :)

Mike said...

How does it compare technically to Greg Hogland's original Rootkit book?

More updated? Different techniques?

Anonymous said...

Based on what I've read so far, the book does cover more recent topics (things like privilege objects and the Windows kernel networking APIs have been significantly renovated since Hoglund & Butler's book was published in 2005).

The Rootkit Arsenal (TRA) generally offers a lot more examples in greater depth. While Hoglund's book might offer a couple of relevant snippets, TRA provides the reader with a complete implementation. Also, code from the TRA is cleaner and easier to read.

I also think TRA covers more ground. Hoglund's book is somewhat lacking when it comes to explaining the finer details of installing and launching a kernel-mode driver and offers only a token gesture towards prerequisite material like using a kernel debugger or the foibles of Intel's architecture.

TRA exhaustively briefs the reader on all this background material and then also dives into more general anti-forensic topics, which are just as pertinent from an offensive perspective.

This probably explains the page count for TRA, which borders on 900+.