Kernel API hooking

Posted on 2009-04-21
Last Modified: 2013-12-03
I need to write something like antivirus, but designed to protect a single application. I need to create a system-wide function hook via kernel driver (I'm not interested in methods such as global dll injection etc, as they're not safe enough). Unfortunetely, I'm not able to find anything about it on Google... not even a single example of hooking a single function. My point is to hook functions such as Read/WriteProcessMemory.

I've heard about few methods of hooking via kernel driver. Some of them mean patching the target function in all applications (like we would do using dll injection) and some of them require patching just a single address in Call Table (but I couldn't find any examples for this one). I need a reliable method of hooking which won't miss even a single call, and as far as I know, the 2nd which I've mentioned would be the best.

But well, my knowledge on this subject is horrible and that's why I'm asking. Probably there are better ways to achieve it and I'd be thankful for any directions.

So summarizing, I need some examples (preferably C++) of how to hook functions from kernel driver and some directions, what is the best way to do it :) The support for win 2k is not obligatory, XP and Vista is just fine :)

If something is unclear, feel free to ask :) Thanks in advance for your help.
Question by:Eriandus
    LVL 86

    Accepted Solution

    You'll find some nice articles on this issue along with full source code here ("Hooking the kernel directly") ("Hooking the native API and controlling process creation on a system-wide basis") ("Kernel-mode API spying - an ultimate hack")
    LVL 3

    Author Comment

    Thanks, I'll test it soon and award points... but I'm facing a silly problem. What compiler should I use for developing drivers and where can I get it (I don't have MSDN subscriber account and I don't live in USA)? I've heard about the DDK but looks like it now got superceded by WDK, and I'm quite confused...
    LVL 86

    Expert Comment

    I don't live in the US either, but any VS version should do nowadays - and the WDK seems to be what you need.
    LVL 3

    Author Closing Comment

    Thank you for your help ;)

    Featured Post

    How to improve team productivity

    Quip adds documents, spreadsheets, and tasklists to your Slack experience
    - Elevate ideas to Quip docs
    - Share Quip docs in Slack
    - Get notified of changes to your docs
    - Available on iOS/Android/Desktop/Web
    - Online/Offline

    Join & Write a Comment

    This article surveys and compares options for encoding and decoding base64 data.  It includes source code in C++ as well as examples of how to use standard Windows API functions for these tasks. We'll look at the algorithms — how encoding and decodi…
    After several hours of googling I could not gather any information on this topic. There are several ways of controlling the USB port connected to any storage device. The best example of that is by changing the registry value of "HKEY_LOCAL_MACHINE\S…
    This is Part 3 in a 3-part series on Experts Exchange to discuss error handling in VBA code written for Excel. Part 1 of this series discussed basic error handling code using VBA.…
    Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…

    754 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    21 Experts available now in Live!

    Get 1:1 Help Now