Various types of hooks in Windows

1. Hook service table: hook ssdt
This method is widely used to intercept native APIs.
Ssdt hook, one sentence-Windows stores all the kernel API addresses to be called
To hook a kernel API for a table (System Service dispatch table), a simple method is
The address saved by this kernel API in the table (ssdt) is changed to the function address you wrote.

2. Hook int 2E method: IDT hook
IDT is the interrupt description table, which can replace the interrupt handler.
This method is widely used for tracing and analyzing system calls. The principle is to replace IDT
The Int 2E interrupt in the table points to our own interrupt service processing routine. Master
This method requires you to have a certain foundation for the protection mode.

3. hook PE method: Eat hook
This method is used to intercept and Analyze function calls of other kernel drivers. Principle
It is implemented based on the corresponding function in the table exported with the replacement PE format.
An eat is an export table of executable files. It records functions that can be used by other programs in the DLL. When an executable file is loaded, the eat table of the corresponding DLL is used to initialize the IAT table, by replacing the function address in the eat table, you can obtain a false address for the program dependent on this DLL.

4. IAT hook (for ring3)
IAT is the import table of the executable file. It records the functions in other DLL used in the executable file. By replacing the function address in the IAT table, you can hook the function calls in the corresponding DLL.

5. inline Hook method (both ring 0 and ring3 can be used)
Inline hook workflow:
1) Verify the kernel API version (pattern matching ).
2) write your own functions to complete the above three tasks.
2) obtain the address of your function and overwrite the kernel API memory for redirection.
Disadvantages of inline HOOK:
1) not general enough. In various Windows versions, the start of kernel APIS is different. To get through, you need to write several more versions.
This document also performs a Pattern Search (because some kernel APIs are very similar in each version, just add something before or after the "pattern ).
2) Some detection tools have been included in the scope of detection. If it is directly overwritten from the first byte of the kernel API, it is easy to be detected. If the coverage range is pushed back and deformed, it may be able to resist. I am not familiar with the specific situation and have not tried it yet.

6. sysentry hook
For the sake of performance, the XP system uses the sysentry command to enter ring0 to call the services in ssdt, instead of using the int 2E in IDT. This also makes the hook easier.
First obtain the sysentry address, and then change it. You don't need to consider IDT any more.

7) IRP hook
IRP is an I/O request packets. The driver contains a series of distribution routines to process requests. These routines are stored in a table in the data structure of the driver object and can be easily replaced.