Pergunta

Can anyone tell me how to check for inline function hooking? I installed the famous root-kit Hacker Defender. It uses inline function hooking technique. But when I check 5 first bytes of the function in Windows API, I can't see op-code for jump instruction. How can I detect whether or not a function is hooked? Thanks.

Nenhuma solução correta

Outras dicas

Rootkit Unhooker can detect inline hooking. enter image description here

GMER also does that according to its specifications.

Licenciado em: CC-BY-SA com atribuição
Não afiliado a StackOverflow
scroll top