Summary

• Hooking interposes on a function boundary to observe or alter behavior — neutral technique, offense and defense both use it.
• IAT: patch a caller's pointer — simple, but misses dynamic resolution and is easy to spot.
• Inline / trampoline: patch the callee's prologue with a jmp; keep a trampoline to call through — great coverage, tricky byte surgery (Detours / MinHook help).
• EAT / vtable / kernel (SSDT, ftrace) extend the same idea.
• Detect by comparing running code / pointers to a trusted baseline.