need snippets for ring 3 (usermode rootkit)

[StoneIce]

Hello,

Been on search for sources and snippets for user mode Rootkit, and most others for n00bkit, I didn't like the one for n00bkit, needing something simpler and the other one I saw was kernel mode, just for security purposes. Kindly assist me with that anyone

Edited July 6, 2015 by StoneIce

[Elohim]

Ring 3 rootkits aren't publicly available, at least recent ones because they cost money, and prices aren't really cheap, getting near and sometimes over 1-1.5k$.

There are a few older examples on rohitab, but besides educational info, you won't get far with those either.

[StoneIce]

Ok, many thanks I managed to see a source code for n00bkit, and I think they used something like detours / api hooking to do the hooking part.

Since I have some knowledge of C, I decided to know if I am thinking correctly here as to using trampolines for api hooking

So when designing something like that, I should employ trampoline / api hook to do a user land rootkit? Is that correct? Kindly let me know

Thanks

Edited July 7, 2015 by StoneIce

[Elohim]

Ok, many thanks I managed to see a source code for n00bkit, and I think they used something like detours / api hooking to do the hooking part.

Since I have some knowledge of C, I decided to know if I am thinking correctly here as to using trampolines for api hooking

So when designing something like that, I should employ trampoline / api hook to do a user land rootkit? Is that correct? Kindly let me know

Thanks

I'm not the best person to give you pointers mate, my understandment of C is still very low, i'm just familiar with the terms.

There is a github with some malware sources and pos malwares put together, in one of them, Alina i think, there is a rootkit. No idea how advanced it is, but it could put you in the right direction.