A forum for reverse engineering, OS internals and malware analysis 

Ask your beginner questions here.
 #15528  by utsav.0202
 Wed Sep 05, 2012 6:00 pm
Hi
I want to prevent any kind of user mode hooks for a specific process.
What is the best possible way to do it?
 #15542  by 16bit
 Thu Sep 06, 2012 2:22 pm
You could focus on trying to prevent anything changing the memory protection on the target module as well as if safe to do so (in your own application), try and prevent anything reading ntdll in a way that it could load a second copy and use it to hook your protected modules. I'm not actually sure of any bulletproof methods as it is possible for another program to hook yours before you're even able to run any code, which would mean it could already have your process hooked before you can try to prevent any hooking.
 #15606  by EP_X0FF
 Sun Sep 16, 2012 10:20 am
Theoretically it is possible without hooking. Remapping image regions and changing protection. But overall results are doubtful.
 #15701  by jack_simin
 Sat Sep 22, 2012 7:17 am
you can find out if some api hooked (comparing first 20-30 bytes api functions with real code from dll) or write your own driver and prevent memory changing on targeted process.