white-papers-defeating-x-64-modern-trends-of-kernel-mode-rootkits.pdf

This ESET technical presentation analyzes the evolution and modern techniques of x64 kernel-mode rootkits and bootkits (TDL4/Olmarik and Win64/Rovnix). It details installation flows, methods to subvert Windows kernel-mode code signing and PatchGuard (BCD manipulation, WinPE abuse, bootloader/MBR/VBR infection), hidden on-disk file systems, driver loading tricks, and debugging/forensic techniques (Bochs, WinDbg, HiddenFsReader). The paper includes code snippets, diagrams, and indicators (file names and MD5s) useful for detection and analysis.