I have researched IAT hooking by malware and i still have a few questions:

  1. If the IAT of the program in memory is different to the IAT of the static program (before it has been ran) does this imply a api hook?

  2. How are these detected i have read the question here: What are the methods to find hooked functions and APIs? but i am still confused could you please provide a basic step by step explaination?

  3. Is there legitimate uses for api hooking other than antiviruses which could lead to false posatives in a detection tool?

  • 1. How are you reading the IAT? A Rootkit that hooks functions could return the correct IAT when requested; therefore hiding the presence of the hooks.
    – xvk3
    Aug 3 '17 at 16:48
  • That's gave me something to think about would windows apis be secure against this ?
    – Nat
    Aug 3 '17 at 16:49
  • Detection of a rootkit that advanced would probably require a kernel mode program. No, hooking functions in this manner is what rootkit developers are doing.
    – xvk3
    Aug 3 '17 at 16:53
  • Ok I was more interested in basic detection then build my knowledge to more advanced detection. But how would a kernal mode program be made?
    – Nat
    Aug 3 '17 at 16:56
  • A well written kernel mode rootkit would be undetectable on normal hardware. Kernel programs/drivers can be written using the Windows Driver Kit (WDK).
    – xvk3
    Aug 3 '17 at 16:59

Detecting a rootkit is by nature difficult, this is because rootkits often employ methods to evade detection. A well written rootkit ought to be undetectable. However, rootkits that are badly coded may leave traces of their activity in the system (failing to delete logs etc).

  • Unsigned Dynamic Link Libraries Loaded into (all) processes
  • Random code checksums
  • General malware detection methods

Also see: https://www.blackhat.com/presentations/bh-europe-06/bh-eu-06-Rutkowska.pdf

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.