What is Inline API Hooking? | Reverse Engineering Interview Questo

Don’t forget to check out the entire playlist here : • OS Internals Concepts ...
In this short video I discussed about Inline Hooking of API used by malware / antivirus softwares. ---
Dont forget to leave a like, comment and subscribe to this channel!
Follow me you twitter:
/ debasishm89
My $15000 WIP Bounty:
• Video
Don't forget to check other popular playlist on BigBountyTube:
IDA Pro Reverse Engineering Tutorial for Beginners
• IDA Pro Reverse Engine...
Building a Machine Learning Based Web App Firewall/IPS from Scratch
• Building a Machine Lea...
Beginners DFIR/Threat Hunting Tutorials with Virus Total
• Beginners DFIR/Threat ...
Reverse Engineering with Intel PIN Tutorial Series
• Reverse Engineering wi...
Reversing with Frida Tutorial Series
• Reversing with Frida T...
Python winappdbg Reversing Video Tutorial Series
• Python winappdbg Rever...

[@bhumiputra6108]

I know that most of the AV are injecting their own DLL in order to do userland API filtering, in functions such as WriteProcessMemory or CreateRemoteThread. But how can they do that? Because from what I know, the AV dll is not in the process import by default, and it is done at the program startup. Is it done by a driver that is notified at each process creation, or by a userland process?I know that most of the AV are injecting their own DLL in order to do userland API filtering, in functions such as WriteProcessMemory or CreateRemoteThread. But how can they do that? Because from what I know, the AV dll is not in the process import by default, and it is done at the program startup. Is it done by a driver that is notified at each process creation, or by a userland process?

[@mmm-me4kk]

Sir thank you for the video , does this also work in this way for x64 operating systems?

[@mmm-me4kk]

Can you also do this in Python? for x64

[@TechnicalHeavenSM]

Good video, and please try to make more videos on frida

[@DebasishMandal]

Thanks,sure..

[@TechnicalHeavenSM]

@@DebasishMandal ok