Class 07 · KP 12 / 19

EAT Hooking and Other Variants (Brief)

IAT hook: overwrite the import pointer so calls jump to your handler.

EAT hooking — patch a DLL's Export Address Table. Later GetProcAddress lookups return your address, so future resolutions are poisoned (existing IAT slots unaffected).
Hotpatch / prologue — Microsoft reserves the mov edi,edi 2-byte NOP + padding for clean 5-byte patches.
VMT / COM vtable hooking — swap a method pointer in an object's virtual method table (C++ / COM objects).
Message / SetWindowsHookEx — OS-provided hooks for keyboard, mouse, and window messages.

Key Takeaway

Wherever a callable address is stored — import table, export table, vtable — there is a hook waiting to be installed.