SDT Kernel mode hooking

Question

I am doing an experiment to successfully hook an API call globally, and I read somewhere about the SDT (Service Descriptor Table) and kernel mode drivers.

Does this sort of hook work for calls that reside within user32.dll and the like?

Answer 1

This will hook everything that need to go kernel-mode to run(I/O, FileSystem, Process/Thread, Kernel Objects).

Although they are very unstable and should not be used. You can only do SDT hooking on x86 systems version as on x64 the KeServiceDescriptorTable symbol is not exported by ntoskrnl and PatchGuard will finalize your system in a bug-check BSOD.

There are many ways to bypass KPP but I don't recommend you to proceed with this.