3 ms·
This is really really easy to detect for malware analysts. One of the first things you look for in memory on a compromised system is hooking. Most rootkits use
by iuguy 16y ago
This is really really easy to detect for malware analysts. One of the first things you look for in memory on a compromised system is hooking. Most rootkits use hooks at different levels to hide or monitor things.
Strangely, on a clean system most hooks tend to be from the Antivirus (usually hooking filesystem calls for on demand scans).
- getsat 16y agoDefinitely. Any amateur effort will generally involve SetWindowsHookEx() + DLL injection to capture keystrokes. The intention was to move this up to ring 0 eventually, but I decided to work on more lucrative things instead.