강의

멘토링

로드맵

Inflearn brand logo image
BEST
Security & Network

/

Computer Security

Windows API hooks that will change your life if you understand them

You will acquire the skills to develop a security system by learning how to intercept the process in which a specific application calls various API functions. ※Absolutely no abuse!!!

(4.8) 25 reviews

447 learners

  • nullnull8537
windows
API
hook
해킹
windows-api
hooking
System Hacking
Reversing

Reviews from Early Learners

What you will learn!

  • How to intercept Windows API calls

  • 64bit based IAT hook, Inline hook

  • How to create a simple security program or malware

A double-edged sword, we'll teach you the skills of both security software developers and malware developers!

"Security technology and hacking technology are so similar that they're practically a sheet of paper apart."

This lecture on Windows API hook technology is designed to assist security software developers. This API hook technology has been around for a long time and is exploited by both good and bad actors. ※Abusion prohibited.

※Caution, some of the examples used in this lecture may be recognized as malware by Windows Defender!

I recommend this to these people

Security software developers
The person you want to be

API hook technology is a technique that must be known, especially for those who want to develop various security programs that operate on PCs .

This class will help you learn only the essentials you need to know.

Before learning reversing techniques
For those who want to study advanced theories in advance

You can analyze the internal structure of a function at the assembly level. Above all, you can understand internal structures not visible in high-level languages and modify them as needed.

As a result, you will be able to gain a high-level understanding and find the answer to the question, 'What is a function?' on your own.

How malware works
Anyone who wants to know

This provides some insight into how malware is injected and executed into legitimate programs . Indeed, many security software uses similar techniques.

However, this lecture does not cover what is required for malware development.

After class

  • You'll gain a new level of understanding of "functions." Perhaps, by the end of this lecture, your understanding of functions will be complete.

  • You'll learn how to go down to the lowest level and solve problems. You'll experience a whole new world you could never have imagined in the world of traditional high-level programming languages.


  • You can update and execute the code of a specific function without terminating the running program developed in C/C++.

Features of this course

Understanding Windows API hooks will change your life.

Provides several techniques for inline hooks

Even when using inline hook technology, there are many specific methods. This lecture covers most of the known techniques and adds new ones to help implement more reliable hook technology . Stability is essential for security software applications.

A lecture that explains how it works

API hook technology itself boasts a high level of difficulty. Even experienced C/C++ developers may find it difficult to understand.

However , if you truly understand the principles, the code itself isn't that difficult. For that reason, I focus on the principles. Above all, I present proven code examples.

Learn about these things

Introduction to PE file structure IAT hook

This article briefly introduces the PE format, which is the format of Windows OS environment executable files (.exe, .dll), and covers how to intercept function calls by manipulating the IAT (Import Address Table) .

However, rather than going into depth about the PE format and related theories, we will cover only the minimum theory required to implement the Hook technique and, as a result, focus on the results of intercepting calls.

Inline hook

This is implemented by directly modifying the machine code of the target function whose calls you want to intercept. In some cases, this can drastically reduce the stability of the hook target. We also explain how to minimize this issue .

Also, most of the materials published on the Internet are based on the x86 environment, but considering that most systems are already 64-bit environments, we will also cover how to implement Inline hooks on the x64 platform .

Do you have any questions?

Q. I'm a student who wants to get a job at a company like AhnLab. Will this course be helpful?

There are differences depending on the field. However, if you're hoping to find a job in a field dealing with PC-level security, the content covered in this course is essential. Without it, you may struggle to find a job. Furthermore, if you want to be even more competitive, kernel driver development experience may also be necessary.

Q. After taking this class, will I be able to create a program like V3?

It helps develop some, if not all, of the features. API hook technology is only a part of the whole, not everything. Furthermore, the core of antivirus systems like V3 lies in the real-time monitoring engine, which is implemented as a kernel driver.

Q. I want to become a malware analysis expert. Will this course help me?

Yes, you've come to the right place! API hook technology is sometimes described as the "flower of reversing." It's as important and frequently used as it is. It's like a Japanese chef's sharp knife. I hope you'll make this course your own.

Things to note before taking the course

Practice environment

  • Operating System and Version (OS): Windows 11

  • Tools used: Visual Studio 2022 Community

  • PC specifications: Anything that can run Visual Studio without any problems is sufficient.

Learning Materials

  • PPT materials used in the lecture are provided in PDF format.

  • Full example (x86, x64 provided separately)

Player Knowledge and Precautions

  • C language programming skills at a level where you have no difficulty using pointers
    (C programming level starting from scratch)

  • Experience reading some disassembled code for debugging purposes (required)

  • Understanding of linear data structures and experience implementing linked lists in C (required)


  • Understanding C++ name mangling (required)

  • Windows system programming experience (required)

  • Socket programming experience sufficient to understand simple TCP/IP chat examples (optional)


Created this course
Knowledge sharer is
👨‍💻

This is Ho-seong Choi, the 'Leisurely Developer' of Leisurely Developer TV.

  • Developer of Korea's first PC firewall (that everyone hates)

  • A 30-year C/C++ developer who has studied the C language since 1992.

  • A man with experience in carrying out numerous national projects and over 15 years of development lecture experience !

  • Author of the popular C language introductory book , "C Programming: A Simple Beginner's Guide to Reading"



Recommended for
these people

Who is this course right for?

  • Developers who want to gain a deep understanding of the internal structure and functions of C/C++ based applications.

  • Anyone who wants to develop security software

  • Anyone who wants to try reverse engineering in a Windows environment

Need to know before starting?

  • High level of understanding of C language

  • Windows system programming (intermediate or higher)

Hello
This is

37,006

Learners

2,150

Reviews

1,098

Answers

4.9

Rating

24

Courses

널널한 개발자 TV 채널 주인장이자
30년 넘게 IT기술의 바다를 항해하고 있는 개발자 입니다.  반갑습니다. ^^  

Curriculum

All

27 lectures ∙ (4hr 6min)

Course Materials:

Lecture resources
Published: 
Last updated: 

Reviews

All

25 reviews

4.8

25 reviews

  • light038368님의 프로필 이미지
    light038368

    Reviews 1

    Average Rating 5.0

    5

    63% enrolled

    • nullnull8537
      Instructor

      Thank you for the good review. :)

  • regniuslee7454님의 프로필 이미지
    regniuslee7454

    Reviews 1

    Average Rating 5.0

    5

    100% enrolled

  • pjoonheeq님의 프로필 이미지
    pjoonheeq

    Reviews 5

    Average Rating 5.0

    5

    63% enrolled

  • sh919park5281님의 프로필 이미지
    sh919park5281

    Reviews 1

    Average Rating 5.0

    5

    33% enrolled

  • aceoftop1975님의 프로필 이미지
    aceoftop1975

    Reviews 95

    Average Rating 5.0

    5

    100% enrolled

    (25/06/29/Sun 08:51) By taking the lecture, I understood hook. I used to think that printf("Hello world"); was simple, but it turned out to be very complex. Thank you for creating a good lecture.

    • nullnull8537
      Instructor

      Wow~! You must be in serious study mode. You've gone beyond encoding, all the way to API hooks. Burning the hot summer with learning sounds like a great choice. I'll support you. Thank you. :)

$51.70

nullnull8537's other courses

Check out other courses by the instructor!