The Design Of Procedure And Document Concealment System Based On Rootkit

Along with the progress of modern social civilization,people’s concern degree inprotecting personal privacy is more and more high, but the success of the informationtechnique revolution，the flying of calculator network and correspondence techniquesoon develops but again to ask people to carry on the share of information. Ability howshare in the convenient information, attain the effective protection to the privacy at thesame time，Be turn to be placed in privilege position operate system in the processingin the information number, its safety becomes more and more important.Rootkit is akind of high class to conceal a technique，analysis and apply it to carry on calculatorsoftware and document to conceal an operation, not only kill for calculator poisonsoftware design, provide operability mechanism applied solid example, make thesafety design the personnel conceal a technique to Rootkit, Be applied to internalstructure and movement principle of operate system to have more deeply one layercomprehension, be advantageous to anti-Rootkit to conceal thus technique ofcontinuously application and progress.This text main completion work is as follows:(1)Forcarried on to describe according to the procedure of Rootkit and therelated background and meaning of the document concealment system design andexperiment research, at the same time summary and analysis the domestic andinternational Rootkit concealment technique develop currently of present condition,concerning Rootkit technique application of source procedure the protection anddocument conceal the successful case of aspect less, and this is also the Rootkittechnique to protect calculator customer’s information to reveal a main applicationdirection of safety，therefore this text at Rootkit technical frame foundation up,designed Rootkit technique procedure and the concealment construction technique ofdocument, hoped for push forward a Rootkit technique positive energy developmentfutrher, provide some works that have theory and fulfillment meaning.(2)TheRootkit and operate system close and related a series of procedure gathers,they or blend in the operate system, or go deep into the core part of operatesystem.Carry out mechanism for the sake of the better comprehension rootkit, we mainly take windows platform as an example，the related operate system principle doessimple introduction.The operate system rises to accept to manage system hardware inthe whole calculator system environment, and for system the customer and softwareprovide the function of friendly use environment.Comprehend the related function thatcheck inside the operate system carries out principle and study to us inside pit classRootkit is to the pass is impotrant?From conceal the means of adoption see，the Rootkitconcealment technique mechanism mainly can return to knot to2types:On being topass to modify a procedure performance, intercept and seize the claim that allinterviews conceal a resources，be called to modify a procedure performancepath(Modify Execution Path, MEP) technique;Two is a direct modification operatesystem to used for the data that supervises and controls a system resources, be calleddirectly inside check an elephant operation(Direct Kernel Object Manipulation DKOM)technique.(3)Passabove-mentioned concerning Rootkit concealment technique of principleanalysis and performance mechanism research, knotting WINDOWS? operate systemsand Rootkit is concealment technique structure characteirstic, develop an according toRootkit concealment technique the procedure in WINDOWS? platform and documentconceal softwareJs mainly divided into three layer classes namely the supervisionlayer of procedure and document, conceal the information processing that performancelayer and system of software respond to and conceal a communication layer, Rootkitthe supervision mold piece of the concealment software designs main function eyesground,be want to carry on a necessary examination towards concealing whetherprocedure and document completing concealment;The system conceals a certain turn adesign to mainly include three parts:The system procedure conceals a design, systemdocument to conceal design and Rootkit to conceal to drive a procedure technique;Thesystem responds to handle a mold piece to design to mainly include,concealmentallocation information, wiretap keyboard and hidden communication design.(4)Rootkitconceals the experiment research of program design and mainlyincludes two patrs, namely the system procedure conceal and conceal an experimentwith document, to the performance software of existing movement WINDOW?operate systems, carry on a rightness should of progress and document conceal, themain step is to pass and apply procedure, conceal procedure and document and dirve,press pack operate system, then add and need the procedure and document name, movement that the safe progress conceals, test result enunciation, conceal a techniqueaccording to Rootkit，for need and carry on a customer a safety protection of can carryout application procedure and document,can carry on an effective progress protection,Be more advantageous to raising a customer and using operate system a safe stability.