## 5 What Could Have Been Done?
### Freely Available Rootkit Detection Tools and Their Comparison
#### 5.3.5 Finding Hooks  
Hooking is one of the oldest techniques implemented in malicious codes. Basically, it manipulates the normal behavior of specified functions or events by patching call tables or codes. Below, we summarize some known hooking techniques that rogue codes typically use and anti-rootkit tools try to spot in the memory:  
* _IAT hooks:_ One of the most popular type of hooks targets the Import Address Table (IAT) of Portable Executable (PE) files (_i.e._,.exe and.dll files), which stores information about API functions used by the program. More specifically, the malicious program injects a DLL into the target process, which overwrites specific IAT table entries such that they point to one of the functions of the malicious DLL, instead of a valid library function. IAT hook detection is a popular capability of free anti-rootkit tools. * _Inline API hooks:_ As opposed to IAT hooks, which can be achieved via function pointer overwrites, inline API hooks require more preparations. First, the malicious code substitutes the first few bytes of the target function with an unconditional jump instruction to a so-called detour function. Second, in order to preserve the original instructions being overwritten, a so-called tramoline function is created, which contains the overwritten instructions and a jump instruction to the rest of the target function. In this way, whenever a target function is called, the control is immediately given to the detour function, which has the ability to pre-process any data flow intended to the target function. The detour function then calls the tramoline function that branches to the target function. When the target function completes its execution, control is returned to the detour function again, which has the ability to post-process any data flow originating from the target function. In this way, the malicious code can take entire control over the inputs and outputs of the hooked API function. * _Other type of hooks:_ By means of message hooks, one can define callback routines (hook functions) to one of the Windows events defined in the winuser.h header file. This can be achieved by means of the SetWindowHookEx Windows API function, which registers a hook routine, residing in a specified DLL, for the specified Windows events (e.g., keystrokes, messages, mouse actions, _etc._). The detection of message hooks is supported by a few anti-rootkit tools. Kernel space hooking offers more exotic and powerful tricks to divert the control flow. By overwriting function pointers in the System Service Dispatch Table (SSDT) and the shadow System Service Dispatch Table (shadow SSDT), one can take control over native API functions to reroute system calls. This means that one can influence the entire behavior of the OS and not just one process. By hooking the vectors of the Interrupt Descriptor Table (IDT), fraudulent Interrupt Service Routines (ISR) can be invoked every time an interrupt or exception occurs. A typical hook is placed on the interrupt vector 0x2e to take control over old-fashioned (e.g., MS Windows 2000) system calls invoked via the int 0x2e instruction. In modern MS Windows operating systems, system calls are generated via fast and native CPU instructions (systemer or syscall). In order to hook them, one has to modify their corresponding Model Specific Registers (MSRs) that store the jump address to a kernel mode code (KiFastCallEntry) being invoked by system calls. In this way, miscreants can divert system calls to their proprietary kernel module quite easily. Note that both the interrupt (int 0x2e) and the instruction (e.g., systemer) based system calls are redirected to the same kernel routine (KiSystemService), which later selects the corresponding native function from the SSDT or shadow SSDT. To manipulate the information flow even more silently, malicious codes can install filter drivers on top of existing system modules (e.g., atop file system drivers) that intercept specified I/O Request Packets (IRP) to take control over the data flow of I/O devices.