joxxx Posted October 16, 2019 Share Posted October 16, 2019 I am studying about a virus.The virus hooks the some functions of nt.dll loaded in to the space of explorer.exe.It seemes that the nt.dll loaded by aother process ( say wordpad.exe) may not be hooked by the virus.Is it possible to compare the the two nt.dll address space and locate the hooked apis.I am using windows XP Link to comment Share on other sites More sharing options...
Scotch Posted October 22, 2019 Share Posted October 22, 2019 try PChunter with r3 process check feature. it will list all hooked functions in any found module and you can also export them into text file. Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now