Вопрос

Can anyone tell me how to check for inline function hooking? I installed the famous root-kit Hacker Defender. It uses inline function hooking technique. But when I check 5 first bytes of the function in Windows API, I can't see op-code for jump instruction. How can I detect whether or not a function is hooked? Thanks.

Нет правильного решения

Другие советы

Rootkit Unhooker can detect inline hooking. enter image description here

GMER also does that according to its specifications.

Лицензировано под: CC-BY-SA с атрибуция
Не связан с StackOverflow
scroll top