QuietRIATT: Rebuilding the Import Address Table
Using Hooked DLL Calls
Jason Raber (jraber@rri-usa.org)
Brian Krumheuer (bkrumheuer@rri-usa.org)
Riverside Research Institute
January 2009
http://www.blackhat.com/presentations/bh-dc-09/Krumheuer_Raber/BlackHat-DC-09-Krumheuer-Raber-QuietRIATT-WhitePaper.pdf