Intercepting hooks and API Calls

Hi,

I have been studying about techniques that could intercept Hooks and API call to select what would be normal operation or illegal call, example:
If detected an hook that monitor the Keyboard, this could be considered a trojan and need be blocked. The same could be said about some API calls that don't have necessity instead when came from the system or a knew application.

I think the best way to implement something to do this would be creating a device driver in kernel mode that implements ways to intercept hooks and messages before it get the target window and decide blocked or no based in a internal database with the rules.

What do you think about this and would be it possible?
Are there some job on this area? Any suggestion?

Thanks,

Cleber P. de Souza
.

Relevant Pages

  • Intercepting hooks and API Calls
    ... I have been studying about techniques that could intercept Hooks and API call to select what would be normal operation or illegal call, ... The same could be said about some API calls that don't have necessity instead when came from the system or a knew application. ... I think the best way to implement something to do this would be creating a device driver in kernel mode that implements ways to intercept hooks and messages before it get the target window and decide blocked or no based in a internal database with the rules. ...
    (microsoft.public.win32.programmer.kernel)
  • Re: Intercepting hooks and API Calls
    ... Detours lib give a very standard way of hooking on to API calls. ... WBR ... Dinesh ... > I have been studying about techniques that could intercept Hooks and API ...
    (microsoft.public.win32.programmer.kernel)