API hooking: intercepting system calls

A hook intercepts a function call to observe or modify it. The technique is neutral: EDRs use it to monitor, malware to hide.

Inline hooking

The first bytes of the target function are overwritten with a jmp to your code (trampoline). After analysis/modification, the saved original bytes run and control returns:

original:  MOV EDI,EDI; PUSH EBP; ...
hooked:    JMP my_handler   ; then runs the saved bytes

IAT hooking instead rewrites the pointers in the Import Address Table. Malware uses hooks to intercept network APIs (data theft), file APIs (hide files), or to bypass checks.

Defence

EDRs detect suspicious hooks by comparing in-memory functions with the on-disk image (integrity check). Modern malware performs unhooking (restores APIs to bypass the EDR) or uses direct syscalls. Verifying the integrity of system DLLs is the countermeasure.