// Comparison

Rootkits and Bootkits vs Techniques virales avancées: Which Should You Read?

Two cybersecurity books on Malware, compared honestly: who each is for, what each does best, and which to read first.

Advanced

4/52019

Reversing Modern Malware and Next Generation Threats

Alex Matrosov, Eugene Rodionov, Sergey Bratus

Matrosov, Rodionov and Bratus on persistent, deeply-embedded malware: kernel rootkits, MBR/UEFI bootkits, and the forensic techniques that surface them. Strongly Windows-internals oriented.

Advanced

4/52007

Techniques virales avancées

Éric Filiol

Specialized follow-up to Filiol's Les virus informatiques. Dives into advanced malicious-code attack techniques and their defensive analysis.

Read this if

Malware analysts who need to handle below-the-OS persistence: kernel rootkits, MBR/UEFI bootkits, hypervisor-based threats. The deep specialist text in this corner of the field.

Readers who've worked through Les virus informatiques and want the next level on evasion, polymorphism, metamorphism.

Skip this if

Generalist malware analysts, or anyone whose work doesn't touch firmware-level threats. The book is dense and assumes Windows internals fluency; readers without that background will struggle.

Readers who haven't read the prior volume. Filiol leans on the formalism set there.

Key takeaways

Bootkits and UEFI rootkits are not theoretical; the book documents real samples (LoJax, MoonBounce, BlackLotus-class) and the techniques that make them detectable.
Secure Boot is necessary but not sufficient; the chapters on UEFI variables and SMM trust are required reading for anyone designing platform security.
Forensic detection of below-the-OS threats requires platform-specific tooling; the book's coverage of memory-acquisition pitfalls and integrity verification is the practical core.

Offense/defense companion to the same school — one of the few French-language titles that goes to this level of detail.
Particularly useful for understanding older classes of evasion techniques that resurface in modern implants.
Together with Les virus informatiques, the most complete French-language academic foundation on the topic.

How they compare

Rootkits and Bootkits and Techniques virales avancées are both rated 4/5 in our catalog. Pick by topic preference and reading style rather than by rating.

Both books target advanced-level readers, so the choice is about topic, not difficulty.

Rootkits and Bootkits and Techniques virales avancées both cover Malware, Reverse Engineering, so reading them in sequence reinforces the same material from different angles.

Keep reading

Rootkits and Bootkits

→ Alternatives to Rootkits and Bootkits → What to read after Rootkits and Bootkits