Detecting Hooks

• Prologue integrity checks — a clean API usually starts with a known prologue; an unexpected jmp / push at byte 0 is suspicious.
• On-disk vs in-memory diff — map the DLL from disk, compare its .text to the running copy; inline patches show up as byte differences.
• IAT / EAT range checks — does each slot point inside the module that is supposed to own it?
• EDR self-protection — vendors watch for tampering of their own hooks (unhooking is a known evasion).