Stealth Hook

Forum for discussion about kernel-mode development.
Post Reply
c6754
Posts: 1
Joined: Sat Feb 16, 2019 1:12 pm

Stealth Hook

Post by c6754 » Sat Feb 16, 2019 1:16 pm

How do I hook without a process seeing it in the stack?

ex. replace getprocaddress in a process without the call being seen on the stack

Do I hook the stack or use KeAttachStackProcess()?

im kinda new to kernel

Post Reply