电脑攻击与防御 The Attack and Defense of ComputersDr. 许.pptVIP

電腦攻擊與防禦  The Attack and Defense of Computers Dr. 許 富 皓 Rootkit for Windows by [Bryce Cogswell et al. ] Categories of Rootkits – Windows User-mode Rootkits Kernel-mode Rootkits User-mode Rootkits Windows API [wikipedia] The Windows API, informally WinAPI, is the name given by Microsoft to the core set of application programming interfaces available in the Microsoft Windows operating systems. It is designed for use by C/C++ programs and is the most direct way to interact with a Windows system for software applications. Windows API [developerfusion] As you know, windows can do lots of things. Manage hardware, run programs, display icons. Much of these functions are carried out by DLL files. DLLs (Dynamic Linked Libraries) store functions, so other programs can access them. The advantage of using DLLs is that the same file can be accessed at the same time by different programs. The functions stored in the windows DLLs are called Windows API. Native API[wikipedia] Lower level access to a Windows system, mostly required for device drivers, is provided by the Native API in current versions of Windows. Windows Library Files -- user32.dll [] user32.dll is a DLL that implements the Windows User API Client Library. It is a core file for several versions of the Microsoft Windows operating system. If this file is damaged or deleted, the operating system will not work. Windows Library Files -- ntdll.dll [] The Native API (with capitalized N) is the publicly mostly undocumented application programming interface used internally by the Windows NT family of operating systems produced by Microsoft. Most of them are in ntdll.dll and ntoskrnl.exe (and its variants). User-mode Rootkits – Utilizing Windows APIs A user-mode rootkit might intercept all calls to the Windows FindFirstFile/FindNextFile APIs, which are used by file system exploration utilities, including Explorer and the command prompt, to enumerate the contents of file system directories. When an applica