Can anyone tell me how to check for inline function hooking? I installed the famous root-kit Hacker Defender. It uses inline function hooking technique. But when I check 5 first bytes of the function in Windows API, I can't see op-code for jump instruction. How can I detect whether or not a function is hooked? Thanks.
1 Answer
Rootkit Unhooker can detect inline hooking.
GMER also does that according to its specifications.
-
Thanks. But I want to write a C++ program to detect it without using available tools. Do you know how?– user2812045Commented May 15, 2014 at 17:18
-
@Thang reverse engineering the program or look for source code.. Commented May 15, 2014 at 17:22
-
If I know the reasons, perhaps I don't waste your time and my time here, also the sites like this are useless.– user2812045Commented May 16, 2014 at 13:40