在远程进程中注入DLL钩挂IAT的方法

Methods of Hooking IAT with Injection DLL into Remote Process

为了安装自定义的函数钩子,可通过钩挂PE文件的导入地址表(IAT)来实现。介绍利用导入表钩挂IAT的2种方法:直接钩挂法和间接钩挂法。用Win32汇编实现2种方法的导入地址表钩子,将DLL注入远程进程中,对钩子模块钩挂IAT的效果进行了测试,结果表明:2种方法都能可靠钩挂IAT。并对钩挂IAT中的一些问题进行了讨论。

In order to install our own function hooks, they are realized by hooking PE file＇ s import address table（IAT）. This pa- per introduces two methods of hook IAT of using the import table： direct hook method and indirect hook method. We used Win32 assembly language to program the two hook routines of the import address table, tested the hooking IAT effects of the hook module after injecting DLL into the remote process. The results showed that the two methods can reliably hook IAT. Some problems for hook IAT are discussed.