https://www.botnets.fr/index.php?action=history&feed=atom&title=XPAJ%3A_reversing_a_Windows_x64_bootkit 2026-10-24T20:49:07Z Revision history for this page on the wiki MediaWiki 1.43.11 https://www.botnets.fr/index.php?title=XPAJ:_reversing_a_Windows_x64_bootkit&diff=3131&oldid=prev 2015-02-07T17:07:28Z

<p>Text replacement - &quot; www.securelist.com&quot; to &quot;&quot;</p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="en"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 17:07, 7 February 2015</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l5">Line 5:</td> <td colspan="2" class="diff-lineno">Line 5:</td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Licence=</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Licence=</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Video=</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Video=</div></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>|Link=https://www.securelist.com/en/analysis/204792235/XPAJ_Reversing_a_Windows_x64_Bootkit <del style="font-weight: bold; text-decoration: none;">www.securelist.com</del></div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>|Link=https://www.securelist.com/en/analysis/204792235/XPAJ_Reversing_a_Windows_x64_Bootkit</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Author=Vyacheslav Rusakov,  </div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Author=Vyacheslav Rusakov,  </div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|NomRevue=Securelist</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|NomRevue=Securelist</div></td></tr> <!-- diff cache key wiki:diff:1.41:old-2300:rev-3131:php=table --> </table>

Eric.freyssinet https://www.botnets.fr/index.php?title=XPAJ:_reversing_a_Windows_x64_bootkit&diff=2300&oldid=prev 2015-02-07T14:26:57Z

<p>1 revision imported</p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="en"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 14:26, 7 February 2015</td> </tr><tr><td colspan="4" class="diff-notice" lang="en"><div class="mw-diff-empty">(No difference)</div> </td></tr> <!-- diff cache key wiki:diff:1.41:old-2299:rev-2300 --> </table>

Eric.freyssinet https://www.botnets.fr/index.php?title=XPAJ:_reversing_a_Windows_x64_bootkit&diff=2299&oldid=prev 2014-08-27T16:31:14Z

<p>Remplacement de texte — « |Editor=Kaspersky » par « |Editor=Kaspersky lab »</p> <p><b>New page</b></p><div>{{Publication<br /> |Image=XPAJ_Reversing_a_Windows_x64_Bootkit.png<br /> |Legend=<br /> |Document=<br /> |Licence=<br /> |Video=<br /> |Link=https://www.securelist.com/en/analysis/204792235/XPAJ_Reversing_a_Windows_x64_Bootkit www.securelist.com<br /> |Author=Vyacheslav Rusakov, <br /> |NomRevue=Securelist<br /> |Date=June 19,2012<br /> |Editor=Kaspersky lab<br /> |Year=2012<br /> |ISBN=<br /> |Page=<br /> |Abstract=Introduction<br /> <br /> The number of bootkits is steadily growing. All kinds of new bootkits are appearing: sophisticated and simple, serving different purposes (such as rootkits or ransomware Trojans). Malware writers are not above analyzing their competitors’ malicious code.<br /> <br /> It is not easy to impress a malware expert with a new bootkit nowadays: boot-record infections have been studied sufficiently in-depth and plenty of information on the subject can be found online. However, this time we have come across an interesting specimen: the Xpaj file infector, complete with bootkit functionality and able to run both under Windows x86 and Windows x64. What makes it stand out is that it successfully runs on Windows x64 with PatchGuard enabled, using splicing in the kernel to protect the infected boot record from being read or modified.<br /> <br /> In this paper, I analyze the rootkit’s operation under Windows 7 x64. It is not worth analyzing the rootkit’s operation under Windows x86, since the malware uses more or less the same algorithm in both operating system versions.<br /> |Botnet=Xpaj, <br /> |Malware=Xpaj (bot), TDL-4 (bot), <br /> |CCProtocol=, <br /> |Operation=, <br /> |Keyword=, <br /> }}</div>

Eric.freyssinet