利用核心态钩挂技术防止代码注入攻击

为防止代码注入攻击，利用钩挂技术来监视有关的API函数调用十分必要。由于Windows NT系统中存在着严格的进程隔离机制，此种钩挂要在核心态下才有效。提出并讨论了实现此种技术的一种简便的方法。实践表明，在Windows XP系统条件下，利用它能够成功阻止木马利用代码注入实现攻击。

Preventing code injection attack with hook in kernel mode

To prevent code injection attack,it is necessary to monitor involved API(Application Programming Interface) by hooking them.Because there exists rigid process isolation in Windows NT,hooking these APIs must be done in kernel mode.A relatively simple way to do this was introduced.It is proved that in Windows XP the way to hook API in kernel mode can efficiently prevent code injection attack.