Class 09 · KP 05 / 25

User Mode: Hooking the Enumeration APIs

IAT hook: overwrite the import pointer so calls jump to your handler.

The trick: intercept the API a tool uses to list things, run the real

call, then filter out rows that mention the rootkit before

returning.

Windows: hide a process by filtering NtQuerySystemInformation results; hide a file by filtering directory-listing results.
The victim tool (Task Manager, dir, ls) never knows its data was edited.