Working with API hooking

In this section, we will look at different techniques for API hooking, from the simple methods that can only alter API arguments to more complex ones that were used in different banking Trojans, including Vawtrak.

Inline API hooking

To hook an API, the malware needs to modify the first few bytes (typically, this is five bytes) of the API assembly code and replace them with jmp <hooking_function> so that it can change the API arguments and maybe skip the call to this API and return a fake result (like an error or just NULL). The code change generally looks like this:

Before Hooking: 
API_START:
    mov edi, edi
    push ebp
    mov esp, ebp
    ...

After Hooking:
API_START:
    jmp hooking_function
    .....