Using IAT Hooking to hook end of function

Question

Is it possible? Maybe you can explain it with a simple example if that's possible?

Answer 1

The IAT entries point to the function's entry point, so you can try the following:

1. Save the current IAT entry value into a variable (e.g. old_func).
2. Patch the IAT entry with the address of your hook function.
3. In the hook function, call the old function using old_func variable, then perform whatever you need before returning to the caller.

Answer 2

Hooking would be the same in both cases:

• Whether you wanted to manipulate a function's parameters, and then provide them to the original function. In that case the order goes:
  1. Execute your hook code.
  2. Call the original function.
• Or call the original function, then manipulate the return results. Order goes:
  1. Call the original function.
  2. Execute your hook code.

In both cases the steps will be:

• Store the original function's entry from the IAT.
• Replace the IAT entry with your hook's start address.
• Do whatever you want inside your hook function.

EDIT: Typos and Language.