admin/Signal-Labs-iat_unhook_sample
1
0
Fork 0
mirror of https://github.com/Signal-Labs/iat_unhook_sample synced 2026-06-08 12:34:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update readme

Browse Source
This commit is contained in:
Christopher Vella
2023-03-30 19:58:16 -07:00
parent 277297600c
commit cffede2a59
1 changed files with 5 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+5 -6
View File
@@ -1,22 +1,21 @@
# Summary
A library and binary (both built via cargo build) for testing unhooking ntdll by identifying hooks via in-memory disassembly,
identifying the original/relocated syscall block for the hooked function and fixing up the IAT pointer appropriately.
A library and binary (both built via cargo build) for testing unhooking ntdll by identifying hooks via in-memory disassembly.
Only works for IAT functions (won't unhook runtime discovered functions e.g. via GetProcAddress), note that this doesn't mean we are limited to fixing patched/modified IAT entries, most tested EDRs/AVs don't patch the IAT directly but the actual start of the function in ntdll itself that the IAT points to. We change the IAT pointer to point to the proper (relocated by the AV/EDR) syscall stub.
`unhook_exports` will walk through the export table of NTDLL and unhook each exported function via in-memory disassembly + patching a jmp to the correct (relocated by EDR) function.
`unhook_iat` only works for IAT functions (won't unhook runtime discovered functions e.g. via GetProcAddress), note that this doesn't mean we are limited to fixing patched/modified IAT entries, most tested EDRs/AVs don't patch the IAT directly but the actual start of the function in ntdll itself that the IAT points to. We change the IAT pointer to point to the proper (relocated by the AV/EDR) syscall stub.
Tested against Sophos free AV.
Only for a sample of unhooking using a technique other than loading a second ntdll or using direct/inline syscalls.
This sample also uses "GetModuleHandleA" for getting the base address of the current process, but there's internal functions (e.g. get_module_by_name) that can replace it to further reduce Windows API usage.
This repository consists of the following:
- src\bin.rs
- Test code that's expected to be ran with a debugger attached (as it contains "int3" instructions to be caught by the debugger), point of this is to run it, step through the first NtWriteVirtualMemory call which should be hooked, then step through the second NtWriteVirtualMemory call which should be unhooked
- src\lib.rs
- Exposes one function 'unhook_iat' which will walk the IAT and unhook any identified hooked NTDLL entries
- Exposes the functions 'unhook_iat' and `unhook_exports`
- src\pe_helper.rs
- Various helper functions for parsing in-memory PE32+ files
- src\pe_defs.rs