A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #32592  by c6754
 Sat Feb 16, 2019 1:16 pm
How do I hook without a process seeing it in the stack?

ex. replace getprocaddress in a process without the call being seen on the stack

Do I hook the stack or use KeAttachStackProcess()?

im kinda new to kernel