Change search
ReferencesLink to record
Permanent link

Direct link
Debug register rootkits: A study of malicious use of the IA-32 debug registers
Blekinge Institute of Technology, School of Computing.
Blekinge Institute of Technology, School of Computing.
2012 (English)Independent thesis Basic level (degree of Bachelor)Student thesisAlternative title
Debug Registers Rootkits : En studie av illasinnad användning av IA-32 debug register (Swedish)
Abstract [en]

The debug register rootkit is a special type of rootkit that has existed for over a decade, and is told to be undetectable by any scanning tools. It exploits the debug registers in Intel’s IA-32 processor architecture. This paper investigates the debug register rootkit to find out why it is considered a threat, and which malware removal tools have implemented detection algorithms against this threat. By implementing and running a debug register rootkit against the most popular Linux tools, new conclusions about the protection of the Linux system can be reached. Recently, debug register rootkits were found on Windows as well. This project intends to bring knowledge about the problem and investigate if there are any threats. Our study has shown that still after 12 years, the most popular tools for the Linux operating system have not implemented any detection algorithms against this threat. The security industry may need to prepare for this threat in case it is spread further.

Place, publisher, year, edition, pages
2012. , 37 p.
Keyword [en]
Debug register, rootkit, IA-32, memory forging, Linux
National Category
Computer Science
URN: urn:nbn:se:bth-3609Local ID: diva2:830919
Available from: 2015-04-22 Created: 2012-06-20 Last updated: 2015-06-30Bibliographically approved

Open Access in DiVA

fulltext(1176 kB)26 downloads
File information
File name FULLTEXT01.pdfFile size 1176 kBChecksum SHA-512
Type fulltextMimetype application/pdf

By organisation
School of Computing
Computer Science

Search outside of DiVA

GoogleGoogle Scholar
Total: 26 downloads
The number of downloads is the sum of all downloads of full texts. It may include eg previous versions that are now no longer available

Total: 23 hits
ReferencesLink to record
Permanent link

Direct link