Software Diagnostics Institute

The short book aims to cover kernel hooks, process injection, I/O filtering, I/O control, memory management, process synchronization, TDI communication, network filtering, email filtering, key logging, process hiding, device driver hiding, registry key hiding, directory hiding, etc. However it is a poorly written book. As the author explains the publisher contacted him after the rootkit was written. 80-90% of the book is just code listings. Code was made looking as being developed incrementally to teach you writing rootkits but that was done post factum and every new code change or addition is not highlighted... There are even code editing mistakes. If you know kernel stuff everything would look obvious but if you don't know there is no explanation. I regret that I ordered and bought it. The amount of information that I digested fits in a couple of pages. Another book written by Greg Hoglund "Rootkits: Subverting the Windows Kernel" is much better.

Not recommended.