1

I have researched IAT hooking by malware and i still have a few questions:

  1. If the IAT of the program in memory is different to the IAT of the static program (before it has been ran) does this imply a api hook?

  2. How are these detected i have read the question here: What are the methods to find hooked functions and APIs? but i am still confused could you please provide a basic step by step explaination?

  3. Is there legitimate uses for api hooking other than antiviruses which could lead to false posatives in a detection tool?

7
  • 1. How are you reading the IAT? A Rootkit that hooks functions could return the correct IAT when requested; therefore hiding the presence of the hooks.
    – xvk3
    Commented Aug 3, 2017 at 16:48
  • That's gave me something to think about would windows apis be secure against this ?
    – Nat
    Commented Aug 3, 2017 at 16:49
  • Detection of a rootkit that advanced would probably require a kernel mode program. No, hooking functions in this manner is what rootkit developers are doing.
    – xvk3
    Commented Aug 3, 2017 at 16:53
  • Ok I was more interested in basic detection then build my knowledge to more advanced detection. But how would a kernal mode program be made?
    – Nat
    Commented Aug 3, 2017 at 16:56
  • A well written kernel mode rootkit would be undetectable on normal hardware. Kernel programs/drivers can be written using the Windows Driver Kit (WDK).
    – xvk3
    Commented Aug 3, 2017 at 16:59

1 Answer 1

1

Detecting a rootkit is by nature difficult, this is because rootkits often employ methods to evade detection. A well written rootkit ought to be undetectable. However, rootkits that are badly coded may leave traces of their activity in the system (failing to delete logs etc).

  • Unsigned Dynamic Link Libraries Loaded into (all) processes
  • Random code checksums
  • General malware detection methods

Also see: https://www.blackhat.com/presentations/bh-europe-06/bh-eu-06-Rutkowska.pdf

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .