Explore kernel mode rootkits in Windows 2000 through this Black Hat conference talk. Delve into advanced techniques for manipulating the Windows kernel, including hooking system calls, hiding files and processes, and runtime kernel patching. Learn about driver structure, device objects, and filtering data using device chains. Discover methods for registering network sniffers, altering security descriptors, and implementing load protection. Gain insights into kernel buffer overflows, exception handling, and kernel-space virus scanning. Understand the challenges of dynamic unloading and strategies for maintaining rootkit persistence.