Managed Code Rootkits

Chapter 6 Extending the Language with a Malware API

Information in this chapter

• Why Should We Extend the Language?

• Extending the Runtime with a Malware API

Many times, code is injected into existing runtime methods as a code block designed to perform a specific task throughout the execution flow. When writing managed code rootkits, wrapping a code block as a method provides a higher-level, abstracted view of the code. It also can eliminate the use of custom code, which means attackers no longer need to reinvent the wheel for each attack. Additional advantages of writing managed code rootkit code are that more generic code can be written through the use of method parameters and that calculations can be passed from these methods by popping ...