Vault7: CIA Hacking Tools Revealed
Navigation: » Directory » Knowledge Base » Tech Topics and Techniques Knowledge Base » Windows » Windows Code Snippets » Windows Function Hooking
Owner: User #71473
Hook Functions via Microsoft Detours (MISCHookFunctions_DTRS)
SECRET//NOFORN
Miscellaneous Module
Stash Repository: Miscellaneous Library
Module Name: MISCHookFunctions_DTRS
Module Description: Hooks the function using Microsoft Detours, which trampolines the call via function prologue patching.
Usage: Forthcoming
PSP/OS Issues: Any PSP/OS issues associated with the technique.
('excerpt' missing)
*Miscellaneous modules should also contain "Excerpt Includes" from every non-miscellaneous module that uses it.
Sharing Level: Unilateral, Liaison, Intelligence Community (Default: Unilateral - until otherwise noted)
Technique Origin: In-house, internet/open-source, reversed malware, stolen, etc.
Notes: Any information that could be useful to anyone maintaining the code or using the code. i.e. This module uses Alternate Data Streams which are only available on NTFSNTMicrosoft operating system filesystem (Windows) volumes.
Module Specific Structures: Any module specific data structures.
Module Return Codes: Any module error/return codes should be described here.
Example Code:
INCLUDE DESCRIPTIVE LABELS FOR EACH MODULE
SECRET//NOFORN