Home / Forums / API Hooking Methodologies: Import Address Table (IAT) Patching vs Inline Trampolines

Tutorial

API Hooking Methodologies: Import Address Table (IAT) Patching vs Inline Trampolines

VMT / Detours Engineer

VIP

Rep: 310

Join Date: Mar 2023

Posts: 22

Thanks: 80

2y ago · Jan 16, 2024 4:30 PM

IAT Hooking swaps the function pointer in the PE .idata section without touching executable code pages.

VMT_Hooker - Virtual method table swapping made easy

The following users thanked VMT_Hooker for this post:

Senior Reverse Engineer

VIP

Rep: 380

Join Date: Apr 2022

Posts: 36

Thanks: 94

2y ago · Jan 16, 2024 8:52 PM

Inline hooking replaces the first 5 bytes (x86) or 14 bytes (x64 jmp [rip+0]) with a jump to a trampoline containing relocated original opcodes.

HexRays99 · Reverse Engineering & Static Analysis

CPP

// Always check your pointers!
if (!pLocalPlayer) return;

Kernel & Systems Researcher

VIP

Rep: 275

Join Date: Jan 2024

Posts: 24

Thanks: 70

2y ago · Jan 17, 2024 10:52 PM

MinHook uses length disassembly to safely relocate partial instructions into the trampoline buffer.

KernelDiver · Windows Internals & Page Tables

Destination Subforum

Thread Prefix

Thread Title

Post Content (BBCode Enabled)

File Attachment

UnreliableCode Community