
220 Cyber seCurity essentiAls
the original function. In this way, a rootkit calls the original function
and modifies its results to hide information.
Hooking using the IAT is not ideal because there are other ways
that the program can call the functions that the rootkit will be unable
to intercept. For example, a program can resolve functions by calling
LoadLibrary to load a DLL file and then calling GetProcAddress to
convert a function name into a memory address.
An alternative strategy that is more effective is to have the root-
kit modify the memory or files associated with each function call.
One common example of this is the use of a trampoli ...