So i was trying to hook the ZwQuerySystemInformation or NtZwQuerySystemInformation using IAT, but i found out that these are not inside the IAT inside the memory nor in the PE file
but maybe i am not importing them properly in my code? because in my sample code which I'm trying to hook I'm basically doing this to get its address :
ZwQuerySystemInformation = (NTSTATUS(__stdcall*)(int, PVOID, ULONG_PTR, PULONG_PTR))GetProcAddress(GetModuleHandle(L"ntdll.dll"), "NtQuerySystemInformation"); ZwQuerySystemInformation(SystemProcessInformation, NULL, NULL, &size);
So my question :
am i using the function wrong in my code and thats why its not IAT? do programs like task manager find the address of it and use it different?
is it possible to do IAT hooking with Nt and Zw functions? if not, why? I mean why its not getting included in IAT? doesn't the loader need to fix the addresses of functions just like any other library that we use?
Why can we use functions like Sleep() without doing stuff like above code and don't need to find its address, but when i try to use ZwQuerySystemInformation or the Nt one, i basically get a segment fault because it tries to access it from address 0 but compiler still recognizes it? if ntdll gets imported into all processes then why can't we get its address automatically?