Linux rootkits and advanced linux programming with C

[scatter]

Hey guys ! sorry for being abscent. I was busy working on a project and I am still working on it , contacts etc etc all the bla bla bla
but anyway I get broed when I focus on only 1 thing so I decided to attack linux rootkits coding etc but to reach that goal I need to learn about advanced linux programming like syscalls , POSIX threads etc etc but I am completely lost. My goal is to be able to code such rootkits in C by the end

https://github.com/chokepoint/azazel/" onclick="window.open(this.href);return false;

and

http://citypw.blogspot.com/2014/08/an-a ... erusu.html" onclick="window.open(this.href);return false;

can anyone advise me good books and guidance from experience ?

PS: Advanced unix programming 3rd edition of W.Richard Stevens sucks , it doesn't explain anything and I am not a medicine student to receive all functions prototypes to learn them by heart without understanding anything which is what was done in that book

thx in advance

[bad_brain]

I can recommend "The Rootkit Arsenal: Escape and Evasion in the Dark Corners of the System"....not THAT much copy&paste code examples, but you can learn all the needed basics from it.

[scatter]

I can recommend "The Rootkit Arsenal: Escape and Evasion in the Dark Corners of the System"....not THAT much copy&paste code examples, but you can learn all the needed basics from it.

thx b_b I have that book already but without understanding the deep working things it will be useless tho. What am looking for is a book like this one
http://poincare.matf.bg.ac.rs/~ivana//c ... o/apue.pdf" onclick="window.open(this.href);return false;
(check its table content) but explains well everything not like what was done in the book , dropping loads of functions prototypes without any good examples or explanation

[bad_brain]

oh, ok...that book is of course not what you're looking for then.
hmmm...what happened to rootkit.com? they had a really nice book (which name I forgot), when I have some spare time (which means: maybe 2051) I might browse my file archive because I am pretty sure I have it....sadly it's totally unorganized...

P.S. if I recall correctly maboroshi afforded the book too from there, maybe he remembers the name...

[maboroshi]

Some really good debugging software while looking at the internal execution of software is ptrace also strace

Code: Select all

http://linux.die.net/man/2/ptrace

I used this for debugging some x86 assembler code. I imagine you can look into the kernel execution of things through this as well *shrugs

*cheers mabo