HUhuhtenberg·Jun 26, 2013
Bootkit alone is probably worth $40k -
https://github.com/hzeroo/Carberp/tree/master/source%20-%20a...
The code looks better than a lot of commercial kernel code of comparable complexity, and it is complex. From readme -
--
Bootkit is a driver for loading other drivers at the OS boot time. Driver is loaded before the initialization of NT kernel (i.e. before the start of the PatchGuard) and it can patch arbitrary kernel code. The driver gets launched before every other drivers, including the boot-time ones, and it can monitor and control their loading. No digital signature is required.
Supported Windows versions - from XP to W8 inclusively.
Supported platforms - x86 and amd64.
Boot-loader works with all types of NTFS partitions.
The code is metamorphic, it consists of several blocks that are randomly rearranged with each build. The IPL
Read the rest
(initial loader) code is encrypted and it is incrementally decrypted during the execution. Considered together, this means that each build of the bootkit is binary unique. The driver is also encrypted when stored on the disk and it is decrypted by IPL upon loading.
--
All in all, this is quite a leak. Very few people can code something like this and it's a unique chance to peek at and learn from their work.