Class 09 · KP 11 / 25

Windows Kernel: IRP Hooking

IAT hook: overwrite the import pointer so calls jump to your handler.

Windows drivers talk via IRPs (I/O Request Packets), dispatched through a driver's MajorFunction[] table.
Replace an entry (e.g. the file-system or network driver's IRP_MJ_DIRECTORY_CONTROL handler) with a rootkit function.
Lets the rootkit filter I/O deep in the stack — hiding files, intercepting disk reads, or tampering with network data.

Key Takeaway

SSDT, DKOM, and IRP hooking are three answers to one question: where in the request path do I lie? — at the syscall table, in the data structures, or in the driver I/O stack.