Interrupt Descriptor Table - Hooking

Hooking

Some Windows applications "hook" calls to the IDT. This involves writing a kernel mode driver that intercepts calls to the IDT and adds in its own processing. This has never been officially supported by Microsoft, but has not been programatically prevented. In 64-bit versions of Windows though this practice has been prevented. A driver that attempts to use a kernel mode hook will cause the machine to bug check.

Read more about this topic:  Interrupt Descriptor Table