基于指令跳转分析的Windows RootKit动态检测技术

RootKit是用来维持黑客对计算机控制,使之无法检测的强力工具。当前传统的RootKit技术都有相对应的检测技术。文章介绍了内核对象内联挂接技术,延伸了现有的代码重定向技术,通过对内核对象调用路径的内联挂接,实现隐藏。现有的RootKit检测技术很难检测这种新型RootKit。因此,文章提出了基于指令跳转分析的动态RootKit检测技术,可以动态检测内核对象内联挂接的RootKit,并且能够指出这些RootKit程序的加载映像。

Dynamic Rootkit Detection Methodology Based on Branch Instruction Analysis

RootKit is a set of powerful tools used by hackers to gain the access to the computers and make itself undetectable.This paper introduces a technique named kernel object inline hooking,which extends existing technique of code redirection,hides tracks through inline hooking of kernel object's dispatch routines.Existing detecting methodology of rootkit is difficult to detect this kind of new rootkit.So this paper illustrates a branch instruction analysis based dynamic detecting methodology of rootkit.This methodology could find running rootkit programs dynamically in the system,and point out the loading images of these rootkits.