WCU / Cybersecurity
~/CSC 471/Class 07/KP 01
Class 07 · KP 01 / 19

What Is API Hooking?

before hookIAT[MessageBoxW]user32!MessageBoxWrealafter IAT hookIAT[MessageBoxW]hook_MessageBoxWattacker
IAT hook: overwrite the import pointer so calls jump to your handler.

Hooking = intercepting a function call so your code runs

before, after, or instead of the real function.

  • The program still "calls MessageBoxW" — but the call is redirected to a handler (a hook / detour).
  • Handler can observe arguments, modify them, block the call, or call through to the original.

Mental model

A hook is a man-in-the-middle placed on a function boundary. Whoever

controls the boundary controls what the program actually does.

Key Takeaway

API hooking redirects control flow at a function boundary so injected code can watch or rewrite behavior transparently.