Managed Code Rootkits

Chapter 3 Tools of the Trade

Information in this chapter

• The Compiler

• The Decompiler

• The Assembler

• The Disassembler

• The Role of Debuggers

• The Native Compiler

• File Monitors

A variety of tools can be used to analyze and modify virtual machine runtimes when deploying managed code rootkits. For instance, compilers can be used to generate executables from high-level source code, decompilers can be used to generate source code from compiled executables, assemblers can be used to generate executables from intermediate language code, and disassemblers can be used to generate intermediate language source code from executables. Plus, debuggers can be used to find bugs or to bypass security checks performed by an executable, and native compilers ...