Kernel API hooking

I need to write something like antivirus, but designed to protect a single application. I need to create a system-wide function hook via kernel driver (I'm not interested in methods such as global dll injection etc, as they're not safe enough). Unfortunetely, I'm not able to find anything about it on Google... not even a single example of hooking a single function. My point is to hook functions such as Read/WriteProcessMemory.

I've heard about few methods of hooking via kernel driver. Some of them mean patching the target function in all applications (like we would do using dll injection) and some of them require patching just a single address in Call Table (but I couldn't find any examples for this one). I need a reliable method of hooking which won't miss even a single call, and as far as I know, the 2nd which I've mentioned would be the best.

But well, my knowledge on this subject is horrible and that's why I'm asking. Probably there are better ways to achieve it and I'd be thankful for any directions.

So summarizing, I need some examples (preferably C++) of how to hook functions from kernel driver and some directions, what is the best way to do it :) The support for win 2k is not obligatory, XP and Vista is just fine :)

If something is unclear, feel free to ask :) Thanks in advance for your help.
Who is Participating?
jkrConnect With a Mentor Commented:
You'll find some nice articles on this issue along with full source code here ("Hooking the kernel directly") ("Hooking the native API and controlling process creation on a system-wide basis") ("Kernel-mode API spying - an ultimate hack")
EriandusAuthor Commented:
Thanks, I'll test it soon and award points... but I'm facing a silly problem. What compiler should I use for developing drivers and where can I get it (I don't have MSDN subscriber account and I don't live in USA)? I've heard about the DDK but looks like it now got superceded by WDK, and I'm quite confused...
I don't live in the US either, but any VS version should do nowadays - and the WDK seems to be what you need.
EriandusAuthor Commented:
Thank you for your help ;)
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.