Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to learn more about rootkits and was hoping to take one and let it loose in a virtual environment.

Does anyone know of a rootkit currently available that I can safely use to do this, and doesn't do too much?

share|improve this question

migrated from stackoverflow.com May 11 '11 at 6:34

This question came from our site for professional and enthusiast programmers.

add comment

2 Answers

A simple google will show you a wide range of rootkits, however, I would not consider any rootkit safe unless I had reviewed all the code personally.

Certainly running it in a virtualised environment with no connection to the outside world is the right thing to do so that if it does have functionality you aren't aware of the risk is minimised.

My advice - first read some of the excellent rootkit analysis material from Symantec, McAfee, Hoglund, Russinovich or ESET. They look at how various rootkits work, and also name ones which may be useful to you.

share|improve this answer
add comment

Look for LRK5 or adore-ng. They are old but they help to understand some principles of user-mode (LRK5) and kernel-mode (adore-ng) rootkits. Sources: LRK5, adore-ng. prack magazine has some interesting articles about this topic as well.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.