API Hooking for Hot-patchable Operating Systems...

[Teddy Rogers]

Most of the approaches to API hooking are several years old at this point, and with Server 2003 and Vista (and XP SP2 to some extent), Microsoft has opened up a new avenue for reliable function replacement in the OS.

The basic technique is public knowledge, but I know of no other articles at this time which apply it to 3rd party API hooking.

The OS now includes what Microsoft has termed “hotpatch” support to allow patches to be applied without requiring a reboot. They have implemented this in a very clever manner, which we will be able to take advantage of for general API hooking.

http://www.codeproject.com/KB/winsdk/0xF9EB_Hooking.aspx

0xF9EB_API_Hooking.zip

Ted.

[evlncrn8]

isn't that just the 'detours' method?