admin/gmh5225-awesome-game-security
1
0
Fork 0
mirror of https://github.com/gmh5225/awesome-game-security synced 2026-06-21 13:56:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

archive: add 5 repo prompt(s) [skip ci]

Browse Source
This commit is contained in:
github-actions[bot]
2026-02-24 13:59:59 +00:00
parent 8456973e2f
commit d90eb93a58
5 changed files with 74409 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
archive/gmh5225/Driver-Detect-nullshit.txt
+460
View File
@@ -0,0 +1,460 @@
Project Path: arc_gmh5225_Driver-Detect-nullshit_rrqmusj6
Source Tree:
```txt
arc_gmh5225_Driver-Detect-nullshit_rrqmusj6
├── README.md
├── defines.h
├── entry.cpp
├── imports.h
├── nullshit.vcxproj
├── nullshit.vcxproj.filters
├── nullshit.vcxproj.user
└── utils.h
```
`README.md`:
```md
# nullshit
Simple Null's driver detector
for info the function that get hooked to do a syscall to manual map your driver will get detected by this if it uses a simple jmp code
```
`defines.h`:
```h
#define dbg(content, ...) DbgPrintEx( 0, 0, content, __VA_ARGS__ )
typedef struct _RTL_PROCESS_MODULE_INFORMATION
{
HANDLE section;
PVOID mapped_base;
PVOID image_base;
ULONG image_size;
ULONG flags;
USHORT load_order_index;
USHORT init_order_index;
USHORT load_count;
USHORT offset_to_file_name;
UCHAR full_path_name[256];
} RTL_PROCESS_MODULE_INFORMATION, *PRTL_PROCESS_MODULE_INFORMATION;
typedef struct _RTL_PROCESS_MODULES
{
ULONG number_of_modules;
RTL_PROCESS_MODULE_INFORMATION modules[1];
} RTL_PROCESS_MODULES, *PRTL_PROCESS_MODULES;
typedef enum _SYSTEM_INFORMATION_CLASS
{
system_basic_information,
system_processor_information,
system_performance_information,
system_time_of_day_information,
system_path_information,
system_process_information,
system_call_count_information,
system_device_information,
system_processor_performance_information,
system_flags_information,
system_call_time_information,
system_module_information,
system_locks_information,
system_stack_trace_information,
system_paged_pool_information,
system_non_paged_pool_information,
system_handle_information,
system_object_information,
system_page_file_information,
system_vdm_instemul_information,
system_vdm_bop_information,
system_file_cache_information,
system_pool_tag_information,
system_interrupt_information,
system_dpc_behavior_information,
system_full_memory_information,
system_load_gdi_driver_information,
system_unload_gdi_driver_information,
system_time_adjustment_information,
system_summary_memory_information,
system_next_event_id_information,
system_event_ids_information,
system_crash_dump_information,
system_exception_information,
system_crash_dump_state_information,
system_kernel_debugger_information,
system_context_switch_information,
system_registry_quota_information,
system_extend_service_table_information,
system_priority_seperation,
system_plug_play_bus_information,
system_dock_information,
system_processor_speed_information,
system_current_time_zone_information,
system_lookaside_information,
system_bigpool_information = 0x42
} SYSTEM_INFORMATION_CLASS, *PSYSTEM_INFORMATION_CLASS;
typedef struct _IMAGE
{
uintptr_t base;
size_t size;
}IMAGE, *PIMAGE;
extern "C"
{
__declspec( dllimport ) NTSTATUS __stdcall ZwQuerySystemInformation( SYSTEM_INFORMATION_CLASS, void *, unsigned long, unsigned long * );
}
```
`entry.cpp`:
```cpp
#include "imports.h"
auto walk_module_exports( IMAGE image ) -> bool
{
if ( !image.base || image.size <= 0x1000 )
{
return false;
}
const auto dos = reinterpret_cast< IMAGE_DOS_HEADER * > ( image.base );
if ( dos->e_magic != IMAGE_DOS_SIGNATURE )
{
return false;
}
const auto nt = reinterpret_cast< IMAGE_NT_HEADERS * >( image.base + dos->e_lfanew );
if ( nt->Signature != IMAGE_NT_SIGNATURE )
{
return false;
}
const auto export_directory = reinterpret_cast< IMAGE_EXPORT_DIRECTORY * >( image.base + nt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress );
const auto address = reinterpret_cast< unsigned long * >( image.base + export_directory->AddressOfFunctions );
const auto name = reinterpret_cast< unsigned long * >( image.base + export_directory->AddressOfNames );
const auto ordinal = reinterpret_cast< unsigned short * >( image.base + export_directory->AddressOfNameOrdinals );
for ( size_t i = 0; i < export_directory->NumberOfNames; i++ )
{
const auto function_address = image.base + address[ordinal[i]];
if ( *reinterpret_cast< unsigned char * >( function_address + 0 ) == 0x48 && // mov
*reinterpret_cast< unsigned char * >( function_address + 1 ) == 0xB8 && // rax
*reinterpret_cast< unsigned char * >( function_address + 10 ) == 0xFF && // jmp
*reinterpret_cast< unsigned char * >( function_address + 11 ) == 0xE0 && // rax
( *reinterpret_cast< uintptr_t * > ( function_address + 2 ) < image.base || // handler is less then driver start address
*reinterpret_cast< uintptr_t * > ( function_address + 2 ) > image.base + image.size ) ) // handler is bigger then driver start address
{
dbg( "%s nigga whatchu thinking", reinterpret_cast< char * > ( image.base + name[i] ) );
}
}
return true;
}
auto driver_entry( ) -> NTSTATUS
{
walk_module_exports( utils::get_kernel_module( "win32kfull.sys" ) );
walk_module_exports( utils::get_kernel_module( "win32kbase.sys" ) );
walk_module_exports( utils::get_kernel_module( "win32k.sys" ) );
walk_module_exports( utils::get_kernel_module( "dxgkrnl.sys" ) );
walk_module_exports( utils::get_kernel_module( "ntoskrnl.exe" ) );
return STATUS_SUCCESS;
}
```
`imports.h`:
```h
#include <ntifs.h>
#include <ntddk.h>
#include <ntimage.h>
#include <ntdef.h>
#include "defines.h"
#include "utils.h"
```
`nullshit.vcxproj`:
```vcxproj
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<ItemGroup Label="ProjectConfigurations">
<ProjectConfiguration Include="Debug|Win32">
<Configuration>Debug</Configuration>
<Platform>Win32</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release|Win32">
<Configuration>Release</Configuration>
<Platform>Win32</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Debug|x64">
<Configuration>Debug</Configuration>
<Platform>x64</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release|x64">
<Configuration>Release</Configuration>
<Platform>x64</Platform>
</ProjectConfiguration>
</ItemGroup>
<PropertyGroup Label="Globals">
<VCProjectVersion>16.0</VCProjectVersion>
<Keyword>Win32Proj</Keyword>
<ProjectGuid>{78ef83b0-472b-484c-b114-fed137ffad75}</ProjectGuid>
<RootNamespace>filter</RootNamespace>
<WindowsTargetPlatformVersion>10.0.22000.0</WindowsTargetPlatformVersion>
<ProjectName>nullshit</ProjectName>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
<ConfigurationType>Driver</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>NotSet</CharacterSet>
<TargetVersion>Windows10</TargetVersion>
<DriverTargetPlatform>Universal</DriverTargetPlatform>
<DriverType>KMDF</DriverType>
<ALLOW_DATE_TIME>1</ALLOW_DATE_TIME>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
<ImportGroup Label="ExtensionSettings">
</ImportGroup>
<ImportGroup Label="Shared">
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<PropertyGroup Label="UserMacros" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
<LinkIncremental>true</LinkIncremental>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
<LinkIncremental>false</LinkIncremental>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<LinkIncremental>true</LinkIncremental>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<LinkIncremental>false</LinkIncremental>
<OutDir>$(SolutionDir)bin\</OutDir>
<IntDir>$(SolutionDir)bin\intermediates\</IntDir>
<TargetName>$(ProjectName)_x64</TargetName>
<EnableInf2cat>false</EnableInf2cat>
</PropertyGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
<ClCompile>
<WarningLevel>Level3</WarningLevel>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
<GenerateDebugInformation>true</GenerateDebugInformation>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
<ClCompile>
<WarningLevel>Level3</WarningLevel>
<FunctionLevelLinking>true</FunctionLevelLinking>
<IntrinsicFunctions>true</IntrinsicFunctions>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
<EnableCOMDATFolding>true</EnableCOMDATFolding>
<OptimizeReferences>true</OptimizeReferences>
<GenerateDebugInformation>true</GenerateDebugInformation>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<ClCompile>
<WarningLevel>Level3</WarningLevel>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
<GenerateDebugInformation>true</GenerateDebugInformation>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<ClCompile>
<WarningLevel>TurnOffAllWarnings</WarningLevel>
<FunctionLevelLinking>true</FunctionLevelLinking>
<IntrinsicFunctions>true</IntrinsicFunctions>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
<LanguageStandard>stdcpp20</LanguageStandard>
<LanguageStandard_C>stdc17</LanguageStandard_C>
</ClCompile>
<Link>
<SubSystem>Native</SubSystem>
<EnableCOMDATFolding>true</EnableCOMDATFolding>
<OptimizeReferences>true</OptimizeReferences>
<GenerateDebugInformation>false</GenerateDebugInformation>
<AdditionalDependencies>%(AdditionalDependencies);$(KernelBufferOverflowLib);$(DDK_LIB_PATH)ntoskrnl.lib;$(DDK_LIB_PATH)hal.lib;$(DDK_LIB_PATH)wmilib.lib;$(KMDF_LIB_PATH)$(KMDF_VER_PATH)\WdfLdr.lib;$(KMDF_LIB_PATH)$(KMDF_VER_PATH)\WdfDriverEntry.lib</AdditionalDependencies>
<IgnoreAllDefaultLibraries>true</IgnoreAllDefaultLibraries>
<MinimumRequiredVersion>$(SUBSYSTEM_NATVER)</MinimumRequiredVersion>
<Driver>Driver</Driver>
<EntryPointSymbol>driver_entry</EntryPointSymbol>
<RandomizedBaseAddress />
<DataExecutionPrevention />
</Link>
</ItemDefinitionGroup>
<ItemGroup>
<ClCompile Include="entry.cpp" />
</ItemGroup>
<ItemGroup>
<ClInclude Include="defines.h" />
<ClInclude Include="imports.h" />
<ClInclude Include="utils.h" />
</ItemGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
<ImportGroup Label="ExtensionTargets">
</ImportGroup>
</Project>
```
`nullshit.vcxproj.filters`:
```filters
<?xml version="1.0" encoding="utf-8"?>
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<ItemGroup>
<ClCompile Include="entry.cpp" />
</ItemGroup>
<ItemGroup>
<ClInclude Include="defines.h" />
<ClInclude Include="imports.h" />
<ClInclude Include="utils.h" />
</ItemGroup>
</Project>
```
`nullshit.vcxproj.user`:
```user
<?xml version="1.0" encoding="utf-8"?>
<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<SignMode>Off</SignMode>
</PropertyGroup>
</Project>
```
`utils.h`:
```h
namespace utils
{
auto get_system_information( const SYSTEM_INFORMATION_CLASS information_class ) -> const void *
{
unsigned long size = 32;
char buffer[32];
ZwQuerySystemInformation( information_class, buffer, size, &size );
const auto info = ExAllocatePoolZero( NonPagedPool, size, 'KLOK' );
if ( !info )
{
return nullptr;
}
if ( ZwQuerySystemInformation( information_class, info, size, &size ) != STATUS_SUCCESS )
{
ExFreePool( info );
return nullptr;
}
return info;
}
auto get_kernel_module( const char *name ) -> IMAGE
{
const auto to_lower = []( char *string ) -> const char *
{
for ( char *pointer = string; *pointer != '\0'; ++pointer )
{
*pointer = ( char )( short )tolower( *pointer );
}
return string;
};
const auto info = ( PRTL_PROCESS_MODULES )get_system_information( system_module_information );
if ( !info )
{
return { 0, 0 };
}
for ( auto i = 0ull; i < info->number_of_modules; ++i )
{
const auto &module = info->modules[i];
if ( strcmp( to_lower( ( char * )module.full_path_name + module.offset_to_file_name ), name ) == 0 )
{
ExFreePool( info );
return { reinterpret_cast< uintptr_t > ( module.image_base ), static_cast< size_t > ( module.image_size ) };
}
}
ExFreePool( info );
return { 0, 0 };
}
}
```
archive/hasherezade/pe-sieve.txt
+25403
View File
File diff suppressed because it is too large Load Diff
archive/noahware/darken-anticheat.txt
+13418
View File
File diff suppressed because it is too large Load Diff
archive/pandora-analysis/pandora.txt
+34359
View File
File diff suppressed because it is too large Load Diff
archive/st4ckh0und/hook-buster.txt
+769
View File
@@ -0,0 +1,769 @@
Project Path: arc_st4ckh0und_hook-buster_a5bf_qp1
Source Tree:
```txt
arc_st4ckh0und_hook-buster_a5bf_qp1
├── LICENSE.md
├── hook-buster
│ ├── hook-buster.vcxproj
│ ├── hook-buster.vcxproj.filters
│ ├── main.c
│ └── native.asm
├── hook-buster.sln
├── make_hash.py
└── outputs
├── crowd-strike.txt
└── sentinel-one.txt
```
`LICENSE.md`:
```md
MIT License
Copyright (c) 2022 Valdemar Carøe
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
```
`hook-buster.sln`:
```sln
Microsoft Visual Studio Solution File, Format Version 12.00
# Visual Studio Version 16
VisualStudioVersion = 16.0.31624.102
MinimumVisualStudioVersion = 10.0.40219.1
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "hook-buster", "hook-buster\hook-buster.vcxproj", "{A0A2E4A9-E403-4BDF-AA1C-D9FAB40D0FD1}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|x64 = Debug|x64
Debug|x86 = Debug|x86
Release|x64 = Release|x64
Release|x86 = Release|x86
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{A0A2E4A9-E403-4BDF-AA1C-D9FAB40D0FD1}.Debug|x64.ActiveCfg = Debug|x64
{A0A2E4A9-E403-4BDF-AA1C-D9FAB40D0FD1}.Debug|x64.Build.0 = Debug|x64
{A0A2E4A9-E403-4BDF-AA1C-D9FAB40D0FD1}.Debug|x86.ActiveCfg = Debug|Win32
{A0A2E4A9-E403-4BDF-AA1C-D9FAB40D0FD1}.Debug|x86.Build.0 = Debug|Win32
{A0A2E4A9-E403-4BDF-AA1C-D9FAB40D0FD1}.Release|x64.ActiveCfg = Release|x64
{A0A2E4A9-E403-4BDF-AA1C-D9FAB40D0FD1}.Release|x64.Build.0 = Release|x64
{A0A2E4A9-E403-4BDF-AA1C-D9FAB40D0FD1}.Release|x86.ActiveCfg = Release|Win32
{A0A2E4A9-E403-4BDF-AA1C-D9FAB40D0FD1}.Release|x86.Build.0 = Release|Win32
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
GlobalSection(ExtensibilityGlobals) = postSolution
SolutionGuid = {098E3592-9BE7-42D3-92A9-33A766CC6006}
EndGlobalSection
EndGlobal
```
`hook-buster/hook-buster.vcxproj`:
```vcxproj
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<ItemGroup Label="ProjectConfigurations">
<ProjectConfiguration Include="Debug|Win32">
<Configuration>Debug</Configuration>
<Platform>Win32</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release|Win32">
<Configuration>Release</Configuration>
<Platform>Win32</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Debug|x64">
<Configuration>Debug</Configuration>
<Platform>x64</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release|x64">
<Configuration>Release</Configuration>
<Platform>x64</Platform>
</ProjectConfiguration>
</ItemGroup>
<PropertyGroup Label="Globals">
<VCProjectVersion>16.0</VCProjectVersion>
<Keyword>Win32Proj</Keyword>
<ProjectGuid>{a0a2e4a9-e403-4bdf-aa1c-d9fab40d0fd1}</ProjectGuid>
<RootNamespace>hookbuster</RootNamespace>
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v142</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
<ImportGroup Label="ExtensionSettings">
<Import Project="$(VCTargetsPath)\BuildCustomizations\masm.props" />
</ImportGroup>
<ImportGroup Label="Shared">
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<PropertyGroup Label="UserMacros" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
<LinkIncremental>true</LinkIncremental>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
<LinkIncremental>false</LinkIncremental>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<LinkIncremental>true</LinkIncremental>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<LinkIncremental>false</LinkIncremental>
</PropertyGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
<ClCompile>
<WarningLevel>Level3</WarningLevel>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
<GenerateDebugInformation>true</GenerateDebugInformation>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
<ClCompile>
<WarningLevel>Level3</WarningLevel>
<FunctionLevelLinking>true</FunctionLevelLinking>
<IntrinsicFunctions>true</IntrinsicFunctions>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
<DebugInformationFormat>None</DebugInformationFormat>
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
<EnableCOMDATFolding>true</EnableCOMDATFolding>
<OptimizeReferences>true</OptimizeReferences>
<GenerateDebugInformation>false</GenerateDebugInformation>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<ClCompile>
<WarningLevel>Level3</WarningLevel>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
<GenerateDebugInformation>true</GenerateDebugInformation>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<ClCompile>
<WarningLevel>Level3</WarningLevel>
<FunctionLevelLinking>true</FunctionLevelLinking>
<IntrinsicFunctions>true</IntrinsicFunctions>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
<DebugInformationFormat>None</DebugInformationFormat>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
<EnableCOMDATFolding>true</EnableCOMDATFolding>
<OptimizeReferences>true</OptimizeReferences>
<GenerateDebugInformation>false</GenerateDebugInformation>
</Link>
</ItemDefinitionGroup>
<ItemGroup>
<ClCompile Include="main.c" />
</ItemGroup>
<ItemGroup>
<MASM Include="native.asm">
<UseSafeExceptionHandlers Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">true</UseSafeExceptionHandlers>
</MASM>
</ItemGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
<ImportGroup Label="ExtensionTargets">
<Import Project="$(VCTargetsPath)\BuildCustomizations\masm.targets" />
</ImportGroup>
</Project>
```
`hook-buster/hook-buster.vcxproj.filters`:
```filters
<?xml version="1.0" encoding="utf-8"?>
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<ItemGroup>
<Filter Include="Source Files">
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
<Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
</Filter>
<Filter Include="Header Files">
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
<Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
</Filter>
<Filter Include="Resource Files">
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
</Filter>
</ItemGroup>
<ItemGroup>
<ClCompile Include="main.c">
<Filter>Source Files</Filter>
</ClCompile>
</ItemGroup>
<ItemGroup>
<MASM Include="native.asm">
<Filter>Source Files</Filter>
</MASM>
</ItemGroup>
</Project>
```
`hook-buster/main.c`:
```c
#include <Windows.h>
#include <winternl.h>
#include <stdio.h>
#define DIRECTORY_QUERY 0x0001
#define DIRECTORY_TRAVERSE 0x0002
typedef enum _SECTION_INHERIT {
ViewShare=1,
ViewUnmap=2
} SECTION_INHERIT, *PSECTION_INHERIT;
extern NTSTATUS ZwClose_impl(HANDLE Handle);
extern NTSTATUS ZwOpenDirectoryObject_impl(PHANDLE DirectoryHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes);
extern NTSTATUS ZwOpenSection_impl(PHANDLE SectionHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes);
extern NTSTATUS ZwMapViewOfSection_impl(HANDLE SectionHandle, HANDLE ProcessHandle, PVOID* BaseAddress, ULONG ZeroBits, SIZE_T CommitSize, PLARGE_INTEGER SectionOffset, PSIZE_T ViewSize, SECTION_INHERIT InheritDisposition, ULONG AllocationType, ULONG Protect);
extern NTSTATUS ZwUnmapViewOfSection_impl(HANDLE ProcessHandle, PVOID BaseAddress);
NTSTATUS NTAPI RtlInitUnicodeStringEx(PUNICODE_STRING DestinationString, PWSTR SourceString)
{
DestinationString->Length = 0;
DestinationString->MaximumLength = 0;
DestinationString->Buffer = SourceString;
if (SourceString == NULL)
return 0;
SIZE_T Length = (SIZE_T)-1;
do
Length++;
while (SourceString[Length] != 0);
if (Length >= 0x7fff)
return 0xC0000106;
USHORT ByteLength = (Length & 0xffff) * sizeof(wchar_t);
DestinationString->Length = ByteLength;
DestinationString->MaximumLength = ByteLength + sizeof(wchar_t);
return 0;
}
BOOL GetKnownDllSectionHandle(LPWSTR DllName, PHANDLE SectionHandle)
{
BOOL Result = FALSE;
UNICODE_STRING KnownDllName = { 0 };
#ifdef _WIN64
RtlInitUnicodeStringEx(&KnownDllName, L"\\KnownDlls");
#else
RtlInitUnicodeStringEx(&KnownDllName, L"\\KnownDlls32");
#endif
OBJECT_ATTRIBUTES KnownDllAttributes = { 0 };
InitializeObjectAttributes(&KnownDllAttributes, &KnownDllName, OBJ_CASE_INSENSITIVE, NULL, NULL);
HANDLE KnownDllDirectoryHandle = NULL;
if (NT_SUCCESS(ZwOpenDirectoryObject_impl(&KnownDllDirectoryHandle, DIRECTORY_TRAVERSE | DIRECTORY_QUERY, &KnownDllAttributes)) && KnownDllDirectoryHandle != NULL)
{
UNICODE_STRING SectionName = { 0 };
if (NT_SUCCESS(RtlInitUnicodeStringEx(&SectionName, DllName)))
{
OBJECT_ATTRIBUTES SectionAttributes = { 0 };
InitializeObjectAttributes(&SectionAttributes, &SectionName, OBJ_CASE_INSENSITIVE, KnownDllDirectoryHandle, NULL);
if (NT_SUCCESS(ZwOpenSection_impl(SectionHandle, SECTION_MAP_EXECUTE | SECTION_MAP_READ | SECTION_QUERY, &SectionAttributes)))
Result = TRUE;
}
ZwClose_impl(KnownDllDirectoryHandle);
}
return Result;
}
DWORD ComputeHash8(LPCSTR string)
{
DWORD hash = 0;
while (*string != 0)
{
hash = _rotr(hash, 13);
hash += *string++;
}
return hash;
}
DWORD ComputeHash16(LPCWSTR string)
{
DWORD hash = 0;
while (*string != 0)
{
hash = _rotr(hash, 13);
hash += *string++;
}
return hash;
}
PVOID GetModuleHandleH(DWORD hash)
{
PEB* peb = NtCurrentTeb()->ProcessEnvironmentBlock;
LIST_ENTRY* head = &peb->Ldr->InMemoryOrderModuleList;
LIST_ENTRY* next = head->Flink;
while (next != head)
{
LDR_DATA_TABLE_ENTRY* entry = (LDR_DATA_TABLE_ENTRY*)((PBYTE)next - offsetof(LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks));
UNICODE_STRING* fullname = &entry->FullDllName;
UNICODE_STRING* basename = (UNICODE_STRING*)((PBYTE)fullname + sizeof(UNICODE_STRING));
if (ComputeHash16(basename->Buffer) == hash)
return entry->DllBase;
next = next->Flink;
}
return NULL;
}
typedef struct _NATIVE_FUNCTION
{
DWORD hash;
PBYTE function;
} NATIVE_FUNCTION;
typedef struct _NATIVE_FUNCTION_ARRAY
{
DWORD size;
NATIVE_FUNCTION functions[4096];
} NATIVE_FUNCTION_ARRAY;
NATIVE_FUNCTION_ARRAY g_function_array = { 0 };
void CollectNativeFunctions(PBYTE base)
{
PIMAGE_DOS_HEADER dos = (PIMAGE_DOS_HEADER)base;
PIMAGE_NT_HEADERS nt = (PIMAGE_NT_HEADERS)(base + dos->e_lfanew);
PIMAGE_EXPORT_DIRECTORY exports = (PIMAGE_EXPORT_DIRECTORY)(base + nt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
if (exports->AddressOfNames != 0)
{
PWORD ordinals = (PWORD)(base + exports->AddressOfNameOrdinals);
PDWORD names = (PDWORD)(base + exports->AddressOfNames);
PDWORD functions = (PDWORD)(base + exports->AddressOfFunctions);
for (DWORD i = 0; i < exports->NumberOfNames; i++)
{
LPSTR name = (LPSTR)(base + names[i]);
PBYTE function = (PBYTE)(base + functions[ordinals[i]]);
if (function > base + nt->OptionalHeader.BaseOfCode &&
function < base + nt->OptionalHeader.BaseOfCode + nt->OptionalHeader.SizeOfCode)
{
if (name[0] == 'Z' && name[1] == 'w')
{
g_function_array.functions[g_function_array.size].hash = ComputeHash8(name);
g_function_array.functions[g_function_array.size].function = function;
g_function_array.size++;
}
}
}
}
}
void BubbleSortFunctions()
{
for (DWORD i = 0; i < g_function_array.size - 1; i++)
{
for (DWORD j = 0; j < g_function_array.size - i - 1; j++)
{
if (g_function_array.functions[j].function > g_function_array.functions[j + 1].function)
{
NATIVE_FUNCTION swap = { 0 };
memcpy(&swap, &g_function_array.functions[j + 1], sizeof(NATIVE_FUNCTION));
memcpy(&g_function_array.functions[j + 1], &g_function_array.functions[j], sizeof(NATIVE_FUNCTION));
memcpy(&g_function_array.functions[j], &swap, sizeof(NATIVE_FUNCTION));
}
}
}
}
DWORD GetFunctionId(DWORD hash)
{
for (DWORD i = 0; i < g_function_array.size; i++)
{
if (g_function_array.functions[i].hash == hash)
return i;
}
return 0xffffffff;
}
int main(int argc, char* argv[])
{
PVOID ntdll = GetModuleHandleH(0xcef6e822);;
if (ntdll != NULL)
{
CollectNativeFunctions((PBYTE)ntdll);
BubbleSortFunctions();
PEB* peb = NtCurrentTeb()->ProcessEnvironmentBlock;
LIST_ENTRY* head = &peb->Ldr->InMemoryOrderModuleList;
LIST_ENTRY* next = head->Flink;
while (next != head)
{
LDR_DATA_TABLE_ENTRY* entry = (LDR_DATA_TABLE_ENTRY*)((PBYTE)next - offsetof(LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks));
UNICODE_STRING* fullname = &entry->FullDllName;
UNICODE_STRING* basename = (UNICODE_STRING*)((PBYTE)fullname + sizeof(UNICODE_STRING));
IMAGE_DOS_HEADER* dos = (IMAGE_DOS_HEADER*)entry->DllBase;
IMAGE_NT_HEADERS* nt = (IMAGE_NT_HEADERS*)((PBYTE)entry->DllBase + dos->e_lfanew);
IMAGE_EXPORT_DIRECTORY* exports = (IMAGE_EXPORT_DIRECTORY*)((PBYTE)entry->DllBase + nt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
if (exports->AddressOfNames != 0)
{
printf("Checking for hooks in %S\n", basename->Buffer);
HANDLE section = NULL;
if (GetKnownDllSectionHandle(basename->Buffer, &section))
{
PVOID base = 0;
SIZE_T size = 0;
if (NT_SUCCESS(ZwMapViewOfSection_impl(section, (PVOID)-1, &base, 0, 0, 0, &size, ViewUnmap, 0, PAGE_READONLY)))
{
WORD* ordinals = (WORD*)((PBYTE)entry->DllBase + exports->AddressOfNameOrdinals);
DWORD* names = (DWORD*)((PBYTE)entry->DllBase + exports->AddressOfNames);
DWORD* functions = (DWORD*)((PBYTE)entry->DllBase + exports->AddressOfFunctions);
for (DWORD i = 0; i < exports->NumberOfNames; i++)
{
char* name = (char*)((PBYTE)entry->DllBase + names[i]);
void* function = (void*)((PBYTE)entry->DllBase + functions[ordinals[i]]);
if ((PBYTE)function > (PBYTE)entry->DllBase + nt->OptionalHeader.BaseOfCode &&
(PBYTE)function < (PBYTE)entry->DllBase + nt->OptionalHeader.BaseOfCode + nt->OptionalHeader.SizeOfCode)
{
DWORD offset = (DWORD)((PBYTE)function - (PBYTE)entry->DllBase);
void* mapped = (void*)((PBYTE)base + offset);
if (memcmp(function, mapped, 5) != 0)
printf("Detected hook in %S!%s\n", basename->Buffer, name);
}
}
ZwUnmapViewOfSection_impl((PVOID)-1, base);
}
ZwClose_impl(section);
}
}
next = next->Flink;
}
}
return 0;
}
```
`hook-buster/native.asm`:
```asm
IFDEF RAX
.code
EXTERN GetFunctionId: PROC
PerformSyscall PROC
mov [rsp+08h],rcx
mov [rsp+10h],rdx
mov [rsp+18h],r8
mov [rsp+20h],r9
mov ecx,eax
sub rsp,28h
call GetFunctionId
add rsp,28h
mov rcx,[rsp+08h]
mov rdx,[rsp+10h]
mov r8,[rsp+18h]
mov r9,[rsp+20h]
mov r10,rcx
syscall
ret
PerformSyscall ENDP
ELSE
.model flat, C
.code
ASSUME FS:NOTHING
EXTERN GetFunctionId: PROC
PerformSyscall PROC
push eax
call GetFunctionId
add esp,04h
mov edx,fs:[0000000c0h]
test edx,edx
jz _is_real_32bit
call edx
ret
_is_real_32bit:
mov edx,esp
sysenter
ret
PerformSyscall ENDP
ENDIF
ZwClose_impl PROC
mov eax,05d044c61h
jmp PerformSyscall
ZwClose_impl ENDP
ZwOpenDirectoryObject_impl PROC
mov eax,03176f0e9h
jmp PerformSyscall
ZwOpenDirectoryObject_impl ENDP
ZwOpenSection_impl PROC
mov eax,092bbde55h
jmp PerformSyscall
ZwOpenSection_impl ENDP
ZwMapViewOfSection_impl PROC
mov eax,0d5189bf4h
jmp PerformSyscall
ZwMapViewOfSection_impl ENDP
ZwUnmapViewOfSection_impl PROC
mov eax,0f2d04fd0h
jmp PerformSyscall
ZwUnmapViewOfSection_impl ENDP
end
```
`make_hash.py`:
```py
import sys
def rotr(x, s):
return ((x >> s) | (x << (32 - s))) & 0xffffffff
if len(sys.argv) != 2:
print("Usage: {} <string>".format(sys.argv[0]))
else:
hash = 0
for c in sys.argv[1]:
hash = rotr(hash, 13)
hash += ord(c)
print(hex(hash))
```
`outputs/crowd-strike.txt`:
```txt
Checking for hooks in ntdll.dll
Detected hook in ntdll.dll!NtAllocateVirtualMemory
Detected hook in ntdll.dll!NtCreateMutant
Detected hook in ntdll.dll!NtDeviceIoControlFile
Detected hook in ntdll.dll!NtGetContextThread
Detected hook in ntdll.dll!NtMapViewOfSection
Detected hook in ntdll.dll!NtProtectVirtualMemory
Detected hook in ntdll.dll!NtQueryInformationThread
Detected hook in ntdll.dll!NtQueueApcThread
Detected hook in ntdll.dll!NtQueueApcThreadEx
Detected hook in ntdll.dll!NtReadVirtualMemory
Detected hook in ntdll.dll!NtResumeThread
Detected hook in ntdll.dll!NtSetContextThread
Detected hook in ntdll.dll!NtSetInformationProcess
Detected hook in ntdll.dll!NtSetInformationThread
Detected hook in ntdll.dll!NtSuspendThread
Detected hook in ntdll.dll!NtUnmapViewOfSection
Detected hook in ntdll.dll!NtUnmapViewOfSectionEx
Detected hook in ntdll.dll!NtWriteVirtualMemory
Detected hook in ntdll.dll!ZwAllocateVirtualMemory
Detected hook in ntdll.dll!ZwCreateMutant
Detected hook in ntdll.dll!ZwDeviceIoControlFile
Detected hook in ntdll.dll!ZwGetContextThread
Detected hook in ntdll.dll!ZwMapViewOfSection
Detected hook in ntdll.dll!ZwProtectVirtualMemory
Detected hook in ntdll.dll!ZwQueryInformationThread
Detected hook in ntdll.dll!ZwQueueApcThread
Detected hook in ntdll.dll!ZwQueueApcThreadEx
Detected hook in ntdll.dll!ZwReadVirtualMemory
Detected hook in ntdll.dll!ZwResumeThread
Detected hook in ntdll.dll!ZwSetContextThread
Detected hook in ntdll.dll!ZwSetInformationProcess
Detected hook in ntdll.dll!ZwSetInformationThread
Detected hook in ntdll.dll!ZwSuspendThread
Detected hook in ntdll.dll!ZwUnmapViewOfSection
Detected hook in ntdll.dll!ZwUnmapViewOfSectionEx
Detected hook in ntdll.dll!ZwWriteVirtualMemory
Checking for hooks in KERNEL32.DLL
Checking for hooks in KERNELBASE.dll
```
`outputs/sentinel-one.txt`:
```txt
Checking for hooks in ntd1l.dll
Checking for hooks in kern3l32.dll
Checking for hooks in ntdll.dll
Detected hook in ntdll.dll!KiUserApcDispatcher
Detected hook in ntdll.dll!LdrLoadDll
Detected hook in ntdll.dll!NtAllocateVirtualMemory
Detected hook in ntdll.dll!NtCreateThreadEx
Detected hook in ntdll.dll!NtCreateUserProcess
Detected hook in ntdll.dll!NtFreeVirtualMemory
Detected hook in ntdll.dll!NtLoadDriver
Detected hook in ntdll.dll!NtMapUserPhysicalPages
Detected hook in ntdll.dll!NtMapViewOfSection
Detected hook in ntdll.dll!NtOpenProcess
Detected hook in ntdll.dll!NtProtectVirtualMemory
Detected hook in ntdll.dll!NtQuerySystemInformation
Detected hook in ntdll.dll!NtQuerySystemInformationEx
Detected hook in ntdll.dll!NtQueueApcThread
Detected hook in ntdll.dll!NtQueueApcThreadEx
Detected hook in ntdll.dll!NtReadVirtualMemory
Detected hook in ntdll.dll!NtResumeThread
Detected hook in ntdll.dll!NtSetContextThread
Detected hook in ntdll.dll!NtSetInformationProcess
Detected hook in ntdll.dll!NtSetInformationThread
Detected hook in ntdll.dll!NtTerminateProcess
Detected hook in ntdll.dll!NtUnmapViewOfSection
Detected hook in ntdll.dll!NtWriteVirtualMemory
Detected hook in ntdll.dll!RtlAddVectoredExceptionHandler
Detected hook in ntdll.dll!RtlGetNativeSystemInformation
Detected hook in ntdll.dll!ZwAllocateVirtualMemory
Detected hook in ntdll.dll!ZwCreateThreadEx
Detected hook in ntdll.dll!ZwCreateUserProcess
Detected hook in ntdll.dll!ZwFreeVirtualMemory
Detected hook in ntdll.dll!ZwLoadDriver
Detected hook in ntdll.dll!ZwMapUserPhysicalPages
Detected hook in ntdll.dll!ZwMapViewOfSection
Detected hook in ntdll.dll!ZwOpenProcess
Detected hook in ntdll.dll!ZwProtectVirtualMemory
Detected hook in ntdll.dll!ZwQuerySystemInformation
Detected hook in ntdll.dll!ZwQuerySystemInformationEx
Detected hook in ntdll.dll!ZwQueueApcThread
Detected hook in ntdll.dll!ZwQueueApcThreadEx
Detected hook in ntdll.dll!ZwReadVirtualMemory
Detected hook in ntdll.dll!ZwResumeThread
Detected hook in ntdll.dll!ZwSetContextThread
Detected hook in ntdll.dll!ZwSetInformationProcess
Detected hook in ntdll.dll!ZwSetInformationThread
Detected hook in ntdll.dll!ZwTerminateProcess
Detected hook in ntdll.dll!ZwUnmapViewOfSection
Detected hook in ntdll.dll!ZwWriteVirtualMemory
Checking for hooks in KERNEL32.DLL
Detected hook in KERNEL32.DLL!Wow64SetThreadContext
Checking for hooks in KERNELBASE.dll
Detected hook in KERNELBASE.dll!CopyFileExW
Detected hook in KERNELBASE.dll!CreateProcessInternalW
Detected hook in KERNELBASE.dll!LoadLibraryA
Detected hook in KERNELBASE.dll!UnhandledExceptionFilter
Checking for hooks in apphelp.dll
Checking for hooks in ADVAPI32.dll
Checking for hooks in msvcrt.dll
Checking for hooks in sechost.dll
Checking for hooks in RPCRT4.dll
```