Class 07 · KP 03 / 19

Types of Hooks: The Landscape

Each attack technique provoked a defense; each defense provoked a new attack.

IAT hooking — swap a pointer in a module's Import Address Table. User mode, per-module.
Inline / trampoline hooking — overwrite the first bytes of the target function with a jmp. User mode, global.
EAT hooking — tamper with a DLL's Export Address Table.
Kernel hooks — SSDT (Windows), ftrace / kprobes (Linux).

(1) Where do we intercept — the caller's table, or the callee's

code? (2) What ring — user mode or kernel mode?

Key Takeaway

Table-based hooks patch pointers; inline hooks patch code. Each choice trades off simplicity, coverage, and detectability.