Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
How Do <strong>Rootkit</strong>s Execute?<br />
<strong>The</strong> IA-32 processor family supports a 4-ring privilege model<br />
Vista only uses two rings (for historical reasons)<br />
Ring 3<br />
Ring 2<br />
Ring 1<br />
Ring 0<br />
User-Mode<br />
Kernel-Mode<br />
© <strong>Below</strong> <strong>Gotham</strong> <strong>Labs</strong>, 2009<br />
Hybrid Model<br />
Mode DPL U/S Flag<br />
User 11B Set<br />
Kernel 00B Clear<br />
9
Change language