Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking?

Question

So i was trying to hook the ZwQuerySystemInformation or NtZwQuerySystemInformation using IAT, but i found out that these are not inside the IAT inside the memory nor in the PE file

but maybe i am not importing them properly in my code? because in my sample code which I'm trying to hook I'm basically doing this to get its address :

ZwQuerySystemInformation = (NTSTATUS(__stdcall*)(int, PVOID, ULONG_PTR, PULONG_PTR))GetProcAddress(GetModuleHandle(L"ntdll.dll"), "NtQuerySystemInformation");

ZwQuerySystemInformation(SystemProcessInformation, NULL, NULL, &size);

So my question :

1. am i using the function wrong in my code and thats why its not IAT? do programs like task manager find the address of it and use it different?

2. is it possible to do IAT hooking with Nt and Zw functions? if not, why? I mean why its not getting included in IAT? doesn't the loader need to fix the addresses of functions just like any other library that we use?

3. Why can we use functions like Sleep() without doing stuff like above code and don't need to find its address, but when i try to use ZwQuerySystemInformation or the Nt one, i basically get a segment fault because it tries to access it from address 0 but compiler still recognizes it? if ntdll gets imported into all processes then why can't we get its address automatically?

Answer 1

"am i using the function wrong in my code and thats why its not IAT? do programs like task manager find the address of it and use it different?"

It is in IAT, but in normal cases executables will never directly import anything from ntdll. Rather all the imports will be from higher level WinAPI modules such as kernel32 (i.e kernel32.VirtualQuery calls ntdll.NtQueryVirtualMemory).

"is it possible to do IAT hooking with Nt and Zw functions? if not, why? I mean why its not getting included in IAT? doesn't the loader need to fix the addresses of functions just like any other library that we use?"

Yes, it's possible, but IAT hooking by its very nature will only redirect execution from the specific module you modify. You can do it through kernel32/kernelbase but it still won't catch anything outside of that.

"Why can we use functions like Sleep() without doing stuff like above code and don't need to find its address, but when i try to use ZwQuerySystemInformation or the Nt one, i basically get a segment fault because it tries to access it from address 0 but compiler still recognizes it? if ntdll gets imported into all processes then why can't we get its address automatically?"

You can import from ntdll manually, you probably did it incorrectly if it resolved to nullptr.