User Mode (Windows): IAT and Inline Hooking

• IAT hooking: every PE has an Import Address Table — a list of pointers to imported functions. Overwrite the pointer for, say, NtQueryDirectoryFile so calls jump to your code first.
• Inline (trampoline) hooking: patch the first bytes of the target function itself with a jmp to your handler; your handler does its work, then jumps back to the original bytes.
• Usually delivered by DLL injection into target processes (e.g. CreateRemoteThread + LoadLibrary).