Abstract:  

Abstract:  In order to install our own function hooks， they are realized by hooking PE file’s import address table(IAT). This paper introduces two methods of hook IAT of using the import table: direct hook method and indirect hook method. We used Win32 assembly language to program the two hook routines of the import address table, tested the hooking IAT effects of the hook module after injecting DLL into the remote process. The results showed that the two methods can reliably hook IAT. Some problems for hook IAT are discussed.

Key words:

 , Key words:  , PE file； import address table； hook IAT

CLC Number: 

• TP393