
CTRL-Z DLL Hooking – SANS Internet Storm Center
When you’re debugging a malware sample, you probably run it into a debugger and define some breakpoints. The idea is to take over the program control before it will perform “interesting” actions. Usually, we set breakpoints on memory management API call (like VirtualAlloc()) or process activities (like CreateProcess(), CreateRemoteThread(), …). The default technique used by debuggers to implement breakpoints…