How to define an API?

Question

I tried to detect the API hook, inline and EAT hook.

Currently, I have not found anything about how to detect an EAT hook.

For the Inline Ring 3 hook that I still have:

FARPROC Address = GetProcAddress(GetModuleHandle("kernel32.dll"),"ExitProcess");
if (*(BYTE*)Address == 0xE9 || *(BYTE*)Address == 0x90 || *(BYTE*)Address == 0xC3)
{
 printf("Api hooked\n");
}

The problem is that there are several operation codes that can be used to intercept / change the function prolog, checking JMP / NOP / RET is trivial, I have seen many types of HOOKs like PUSH RET, MOV, RETN, etc ... .

I wonder if anyone knows how to detect these hooks (workarounds) or changes in the API. As well as an EAT hook detection method.

Thank.

Answer 1

GetProcAddress . , API, , , . API-, , - . , dll . / (, Themida) , " " .

Answer 2

, kernel32.dll dll , IAT , .

, kernel32.dll API DLL.

Answer 3

IAT- , .

, memcmp(), () , , IAT .