I am doing an experiment to successfully hook an API call globally, and I read somewhere about the SDT (Service Descriptor Table) and kernel mode drivers.
Does this sort of hook work for calls that reside within user32.dll and the like?
Share
Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I am doing an experiment to successfully hook an API call globally, and I read somewhere about the SDT (Service Descriptor Table) and kernel mode drivers.
Does this sort of hook work for calls that reside within user32.dll and the like?
This will hook everything that need to go kernel-mode to run(I/O, FileSystem, Process/Thread, Kernel Objects).
Although they are very unstable and should not be used. You can only do SDT hooking on x86 systems version as on x64 the KeServiceDescriptorTable symbol is not exported by ntoskrnl and PatchGuard will finalize your system in a bug-check BSOD.
There are many ways to bypass KPP but I don’t recommend you to proceed with this.