Class 09 · KP 08 / 25
Windows Kernel: SSDT Hooking
IAT hook: overwrite the import pointer so calls jump to your handler.- User-mode calls (e.g.
NtQuerySystemInformation) trap into the kernel; a dispatcher looks up the handler in the SSDT (System Service Descriptor Table). - The core table is
KiServiceTable: an array of function pointers indexed by syscall number. - An SSDT hook overwrites one pointer so the syscall runs the rootkit's function instead of the real kernel routine.
- Classic targets:
NtQueryDirectoryFile (hide files), NtQuerySystemInformation (hide processes).