Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Detect IAT patching #57

Closed
hasherezade opened this issue Mar 29, 2020 · 1 comment
Closed

Detect IAT patching #57

hasherezade opened this issue Mar 29, 2020 · 1 comment
Assignees
@hasherezade
Labels
enhancement

Comments

@hasherezade
Copy link
Owner

Implement scanning IAT on demand (enabled by a parameter) against classic IAT hooking.

Test case:

Classic IAT hooking (implemented using IAT Patcher): cm_hooked.zip
The replacement function was defined in the following way:

replacement

The scan output should look like:

1000100c;User32.MessageBoxW->NagMeNot.dll.MBox;10000000+100c;0
@hasherezade hasherezade self-assigned this Mar 29, 2020
hasherezade added a commit that referenced this issue Apr 12, 2020
@hasherezade
Merge branch 'iat_hooks' (Issue #57)
98f6159
hasherezade added a commit that referenced this issue Apr 13, 2020
@hasherezade
Merge branch 'iat_hooks2' (Issue #57)
7fed51e
hasherezade added a commit that referenced this issue Apr 13, 2020
@hasherezade
[BUGFIX] In IATScanReport: removed redundant delimiter. Reoport invalid
3cb2e03 
hooks. (Issue #57)
hasherezade added a commit that referenced this issue Apr 13, 2020
@hasherezade
[BUGFIX] In IATScanReport: do not filter out hooks leading to unknown…
e449935 
… modules. (Issue #57)
@hasherezade
Copy link
Owner Author

PE-sieve accepts a new parameter: /iat allowing to scan for IAT hooks. If found, hooks are listed in additional report.
Report for the above sample :

4068;user32.MessageBoxW #533->nagmenot.MBox #1;10000000+100c;0

Format:

<call via RVA>;<original function>-><hook function>;<hook module addr>+<offset>;<is module detected as suspicious>

This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@hasherezade hasherezade

Labels
enhancement
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@hasherezade