C - JRK - JetaRootkit
I have literally no use for this, I just wrote it for the fun of it, and of course it's a subject that interests me. So I'll be posting the source code for it here. One rule with this rootkit, you're not allowed to distribute it in source code, or binary form without my permission. You're also not allowed to use it to hide malware(and I wouldn't, the SSDT hooking methods is easily detectable). The only exception, is when you're distributing it to a privately owned virtual machine for testing. Sometime after taekwondo belt testing, when I have more time, I'll implement a method which alters all imports of the KeServiceDescriptorTable to change it's SDT member to a copied SDT, thus when it's being scanned for modifications, it will be scanning a copied and inactive SDT. Same for when it's being hooked by other drivers, the hooks will only exist in the copied inactive SDT. Anyway, you're allowed to use this for learning purposes only.
Also note the whole source code is written in C.
Source code is in attachments.
Also note the whole source code is written in C.
Source code is in attachments.
JRK.rar