Examples of IAT hijack

Since each IMAGE_THUNK_DATA in an IAT holds the system function address, wouldn’t it be possible to monitor and hijack a program’s active behavior if we could overwrite the contents of IMAGE_THUNK_DATA with a function for monitoring purposes? The answer is yes. Let’s try it out with a sample program.

The following example is the source code of iatHook.cpp in the Chapter#5 folder of the GitHub project. In order to save space, this book only extracts the highlighted code; please refer to the full source code to read the full project:

Figure 5.10 – The iathook function

Figure 5.10 shows the source code of the iatHook function, which reads in four parameters:

• module: Points to the loaded module to be monitored
• szHook_ApiName: The name of the function to be hijacked
• callback: The function for monitoring purposes
• apiAddr: The original correct address of the hijacked function

At...