首页
社区
课程
招聘
[原创]HookShark
发表于: 2008-10-7 08:36 4287

[原创]HookShark

2008-10-7 08:36
4287
HookShark
I. Description
HookShark is a detector of installed hooks and patches installed on the system (only usermode for
now). It scans through the code-section of every loaded module of each running process and
compares it with the file-image. If it detects discrepancies it tries to determine the type of hook or
patch and reports it to the user. The detailed report about the type of patch is not 100% reliable and
can be wrong. HookShark makes many assumptions and guesses during analysis and report,
because of the nature of assembly. In some cases we can't theoretically determine with 100%
accuracy whether a block of bytes is data or code. We also can not determine where the next
instruction begins, if we are in the middle of a patched block of bytes. An almost safe presumption
can only be achieved through full-blown x86 emulation tracing from the entry-point of the binary. But
even then not all execution paths are necessarily covered. Yes, even IDA has problems with this in
extreme cases.
II. Implented / planned features
Currently implented:
- Inline patches / Hooks (NOP, Exceptionhandler, relative Jumps, Custom patches)
- Other custom patches [...]
- IAT and EAT Hooks
- Relocation Hooks
- Hardware Breakpoints
Planned:
- PAGE_GUARD Hooks
- PEB LdrList Hooks
- TrapFlag Usage "Hooks"
III. Participate in Beta
It is an open BETA now. Download the too here [1]

[1] HookShark.rar
IV. Devblog

08-14-2008
Just finished detection of Hardware Breakpoints. Seems to work well. Funnily enough two threads
inside winlogon.exe have enabled 4 Hardware Breakpoints on invalid memory (WinXP SP2). I have
no idea why though. Unhooking still only works on:

- Inline patches / Hooks (NOP, Exceptionhandler, relative Jumps, Custom patches)

I am thinking about opening public Beta very soon.
Code:

http://home.arcor.de/neotracer/HookShark.rar

[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课

收藏
免费 0
支持
分享
最新回复 (1)
雪    币: 456
活跃值: (150)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
2
感謝提供 分享
2008-10-7 13:10
0
游客
登录 | 注册 方可回帖
返回
//