WCU / Cybersecurity
~/CSC 471/Class 09/KP 08
Class 09 · KP 08 / 25

Windows Kernel: SSDT Hooking

before hookIAT[MessageBoxW]user32!MessageBoxWrealafter IAT hookIAT[MessageBoxW]hook_MessageBoxWattacker
IAT hook: overwrite the import pointer so calls jump to your handler.
  • User-mode calls (e.g. NtQuerySystemInformation) trap into the kernel; a dispatcher looks up the handler in the SSDT (System Service Descriptor Table).
  • The core table is KiServiceTable: an array of function pointers indexed by syscall number.
  • An SSDT hook overwrites one pointer so the syscall runs the rootkit's function instead of the real kernel routine.
  • Classic targets: NtQueryDirectoryFile (hide files), NtQuerySystemInformation (hide processes).