دوره Rootkit

Module 01 – Foundations

Rootkit != Malware
Overview Anti-Forensics Technics
Hardware Briefing
Memory Models
Real Mode
Protected Mode
Memory Protections
Windows System Briefing
Physical Memory
Segmentation and Paging
User Space and Kernel Space
User Mode and Kernel Mode
Memory Protections Features
Undocumented and Native AIP
Windows Boot Loader
Kernel Space
Kernel Mode Driver
Service Controler Manager
Export Driver
Kernel Mode Security

Module 02 – Persistence

File System Analysis
Static Analysis
Packers
Metamorphic Codes
Data Fabrication
Runtime Analysis
API Tracing
Detecting User Mode Debugger
Detecting Kernel Mode Debugger
Detecting VM
Obfuscation Application Data

Module 03 – Hooking

User Mode Loaders
Shellcode Programming in C
Kernel Mode ShellCode
Hooking in User Space
Hooking the IDT
Hooking the MSRs
Hooking the SSDT
Hooking the IRP
Hooking the GDT
Modifying Code
In-Place Patching
Detour Pathing
Modifying Kernel Object
The Bootkits
UAC Bypass Methodology

Module 04 – Covert Channels

Protocol Tunneling
DNS Tunneling
ICMP Tunneling
Internet Social Media
HTTP and HTTPS