Windows内核级Rootkits隐藏技术的研究  

Research on Stealth Technology of Windows Kernel-level Rootkits

作　　者：龚广[1] 李舟军[1] 忽朝俭[1] 邹蕴珂[1,2] 李智鹏[1] 

机构地区：[1]北京航空航天大学计算机学院,北京100191 [2]海军装备研究院,北京100161

出　　处：《计算机科学》2010年第4期59-62,共4页Computer Science

基　　金：国家自然科学基金(60473057;90604007;90718017);教育部博士点基金(20070006055)资助

摘　　要：随着Rootkits技术在信息安全领域越来越受到重视,各种Anti-rootkits新技术不断出现。在各种Anti-root-kits工具的围剿下,常规的Rootkits隐藏技术难以遁形。在系统分析和深入研究传统内核级Rootkits隐藏技术的基础上,提出了一个集驱动模块整体移位、内核线程注入、IRP深度内联Hook 3种技术为一体的Rootkits隐藏技术体系。实验结果显示,基于该隐藏技术体系所实现的Rootkits能够很好地躲避专业的Anti-rootkits工具(如Rootkit Unhooker和冰刃)的检测,从而充分表明了这种三位一体的Rootkits隐藏技术体系的有效性。With more and more attention being paid to the Rootkits technology in the fields of cyber-security, various new Anti-rootkits technologies have emerged continually. Under the detection of various Anti-rootkits tools, the conventional Rootkits stealth technology is difficulty to play its role. Based on systematic analysis and research of traditional kernel-level Rootkits stealth technology, this paper presented a three-in-one rootkits stealth technical architecture on the basis of driver module integral transposition, kernel threads iniection and IRP inline Hook in depth. Experimental results show that the Rootkits based on this stealth architecture can well bypass the detection of some well-known Anti-rootkits tools （such as Rootkit Unhooker and IceSword）, which fully demonstrates the effectiveness of this three-in-one Rootkits stealth technical architecture.

关 键 词：ROOTKITS Anti—rootkits 驱动模块整体移位 内核线程注入 IRP深度内联Hook 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]