Designing BSD Rootkits An Introduction to Kernel Hacking (Joseph Kong) (Z-Library)

# Designing BSD Rootkits: An Introduction to Kernel Hacking ## 【One-Line Pitch】 A hands-on tutorial for programmers who want to understand FreeBSD kernel internals by learning how rootkits work—both to write them and to defend against them. If you're comfortable with C and curious about kernel programming, this book takes you from zero to practical kernel-hacking skills. ## 【Book Arc】 - **Opening (~0%–10%)**: Introduces the book's dual-purpose philosophy—rootkits as both offensive and defensive tools—and lays out the roadmap: kernel module fundamentals, hooking techniques, direct object manipulation, and detection/removal strategies. - **Early (~10%–23%)**: Covers Loadable Kernel Modules (KLDs) from the ground up, including the DECLARE_MODULE macro, module event handlers, and the mechanics of how modules register with the kernel. This section assumes no prior kernel experience but moves quickly. - **Early (~23%–32%)**: Dives into system call modules—how to install new system calls and the three essential components: the system call function, the sysent structure, and the offset value. Includes complete, runnable examples with user-space test programs. - **Middle (~32%–42%)**: Introduces character device modules, explaining the cdevsw structure and device registration. Emphasizes the kernel source tree at /usr/src/sys/ as the best learning resource and recommends setting up a debug kernel for development. - **Middle (~42%–48%)**: Shifts to hooking techniques, starting with system call hooking—replacing kernel functions like mkdir with custom versions that log or alter behavior. Shows how to modify the sysent[] table directly. - **Late (~48%–end)**: Covers Direct Kernel Object Manipulation (DKOM)—hiding processes by manipulating kernel data structures like allproc and pidhashtbl, hiding network ports via inpcb structures, and corrupting kernel data. Concludes with kernel object hooking and detection/removal strategies. ## 【Key Takeaways】 - **KLDs are the entry point to kernel hacking** (Early): Loadable Kernel Modules are the foundation for everything in this book. Understanding the DECLARE_MODULE macro, event handlers, and module lifecycle is essential before attempting any rootkit technique. - **System call modules require three components** (Early): Every system call module needs a system call function, a sysent structure describing its arguments, and an offset value. The book provides complete examples that compile and run, making this abstract concept concrete. - **The kernel source tree is your best teacher** (Middle): The author repeatedly points readers to /usr/src/sys/ as the definitive reference. Much of the book's code is gleaned directly from there, so learning to navigate it is a core skill. - **System call hooking is the simplest rootkit technique** (Middle): Replacing entries in the sysent[] table—like swapping mkdir for a custom version—demonstrates how easy it is to intercept kernel operations. This technique is both a learning tool and a real-world attack vector. - **DKOM manipulates kernel data structures directly** (Late): Hiding processes requires understanding FreeBSD's list macros (LIST_HEAD, LIST_FOREACH, LIST_REMOVE) and synchronization primitives like mutexes. The book walks through hiding processes from both the allproc list and pidhashtbl. - **Synchronization is critical when manipulating kernel objects** (Late): The book emphasizes using mtx_lock/mtx_unlock and sx_slock/sx_xlock to avoid corrupting kernel state. This is where many novice kernel hackers make mistakes. - **Rootkit detection is the flip side of the same coin** (Late): The final section focuses on detecting and removing the techniques taught earlier, giving defenders the knowledge to spot these attacks in the wild. ## 【Reading Tips】 - **Skim Chapter 1 if you're already comfortable with C and operating systems**: The KLD fundamentals are necessary but straightforward. Focus on the system call module example (Listing 1-3) and the character device example—these reappear throughout the book. - **Deep-read Chapters 2–6 for the core techniques**: These chapters cover the gamut of rootkit methods. Pay special attention to the complete code listings—they're not just illustrative but are the actual tools you'll adapt. - **Set up a FreeBSD test environment before starting**: The book assumes you'll experiment. A debug kernel or kernel-mode debugger is strongly recommended, and the author points to specific online resources for setup help. - **Don't skip the synchronization sections**: The discussion of mutexes and sx locks in Chapter 3 might seem dry, but it's essential for writing code that doesn't crash the kernel. This is where theory meets practice. - **Use the kernel source tree as a companion**: When the book references a structure or function, look it up in /usr/src/sys/. This habit will accelerate your learning far beyond the book's examples. ## 【Coverage Limits】 This guide covers the book's structure and key techniques through the middle sections, including KLD fundamentals, system call modules, character devices, and the beginning of hooking techniques. The excerpts do not cover the later chapters on kernel object hooking details, network protocol hooking, or the final detection/removal chapter in depth. ##