The final technique worth mentioning in SSDT hooking is hooking the functions that are referenced in the SSDT. This is very similar to API hooking. In this case, malware gets the function from the SSDT using the function ID and patches the first few bytes with jmp <malicious_func>. It then returns the execution back to the original function after checking the process that called this function and its parameters.
This technique is used because SSDT hooks can be easily detected by antivirus or rootkit scanning programs. It's easy to loop through all the functions inside the SSDT and search for a function that is outside the legitimate driver's or application's memory image.
That's all for SSDT hooking; now, let's take a look at layered drivers or IRP hooking.
