Learning Malware Analysis

4.1 IAT Hooking

As mentioned earlier, the IAT contains the addresses of functions that an application imports from DLLs. In this technique, after a DLL is injected into the target (legitimate) process, the code in the injected DLL (Dllmain() function) hooks the IAT entries in the target process. The following gives a high-level overview of the steps used to perform this type of hooking:

• Locate the IAT by parsing the executable image in memory.
• Identify the entry of the function to hook.
• Replace the address of the function with the address of the malicious function.

To help you understand, let's look at an example of a legitimate program deleting a file by calling the DeleteFileA() API. The DeleteFileA() object accepts a single parameter, ...