0

Can anyone tell me how to check for inline function hooking? I installed the famous root-kit Hacker Defender. It uses inline function hooking technique. But when I check 5 first bytes of the function in Windows API, I can't see op-code for jump instruction. How can I detect whether or not a function is hooked? Thanks.

0

1 Answer 1

1

Rootkit Unhooker can detect inline hooking. enter image description here

GMER also does that according to its specifications.

3
  • Thanks. But I want to write a C++ program to detect it without using available tools. Do you know how?
    – user2812045
    Commented May 15, 2014 at 17:18
  • @Thang reverse engineering the program or look for source code.. Commented May 15, 2014 at 17:22
  • If I know the reasons, perhaps I don't waste your time and my time here, also the sites like this are useless.
    – user2812045
    Commented May 16, 2014 at 13:40