Hook API

Assembly blocks for hooking windows API functions.

iat_hook.asm

It finds the import address table index of API functions by parsing the _IMAGE_IMPORT_DESCRIPTOR structure entries inside the import table of the PE file. It first calculates the ROR(13) hash of the (module name + function name) and compares with the hash passed to block. If the hash matches it replaces IAT entry with the passed address. Sometimes the memory space that is containing the import address table is not writable by the running thread. In such cases this block uses VirtualProtect function for changing the virtual address space permissions that is containing the IAT entry we want.

IMPORTANT !!

• The function that is called with hook_api must be imported by the PE file or it will crash.

Example

Following code hooks the DeleteFileA windows API function using the hook_api block. After hooking the function it will always return nonzero value. When a process executes this code it will not able to delete any file.

[BITS 32]
    pushad                  ; Save all registers to stack
    pushfd                  ; Save all flags to stack
    cld                     ; Clear direction flags
    call start              ; call start
    %include "iat_api.asm"  ; iat_api.asm goes here
start:                      ; ...
    pop ebp                 ; Pop out the address of iat_api.asm to EBP
    call fin                ; Push the address of hooked code to stack
hooked_code:                ; ...
    mov eax,0xFF            ; Move non-zero value to EAX
    ret                     ; Return
fin:                        ; ...
    push 0x13DD2ED7         ; hash( "KERNEL32.dll", "DeleteFileA" )
    call ebp                ; Call the iat_api block
    popfd                   ; Pop back saved flags
    popad                   ; Pop back saved registers
    ret                     ; Return to caller

Following code hooks the TerminateProcess windows API function using the hook_api block. After hooking the function it will always return nonzero value. When a process executes this code it will not able to terminate any other process with TerminateProcess API function.

[BITS 64]

    cld                     ; Clear direction flags
    push r10                ; Save R10 register
    %include "iat_api.asm"  ; iat_api.asm goes here
start:                      ; ...
    pop rbp                 ; Pop out the address of iat_api.asm to RBP
    call get_return_true    ; Call get_return_true
return_true:                ; ...
    mov rax,0x01            ; Move non zero value to RAX
    ret                     ; Return
get_return_true:            ; ...
    mov r10d,0x5ECADC87     ; hash( "KERNEL32.dll", "TerminateProcess" )
    call rbp                ; Call the iat_api block
    pop rax                 ; Clear stack
    pop r10                 ; Restore R10
    ret                     ; Return to caller

inline_hook.asm

It finds the address of the target API functions by parsing the PEB->Ldr->InMemoryOrderModuleList. After finding the address it replaces the beginng of the function with the given patch binary. This binary can be used as a prologue for redirecting the target API function to elsewhere or returning any arbitrary value.

Example

Following code hooks the AdjustTokenPrivileges windows API function using the inline_hook.asm block. After hooking the function it will always return nonzero value. When a process executes this code it will not be able to escalate privileges.

Content of patch binary

    db 0x32,0xc0  ; xor eax,eax
    db 0xc3       ; ret 

x86 Hook code:

[BITS 32]


	cld                             ; Clear direction flags
	call get_hook_api               ; Get the address of inline_hook_api.asm to stack
	%include "inline_hook.asm"      ; inline_hook.asm goes here
get_hook_api:                       ; ...
	pop ebp                         ; Pop out the address of inline_hook_api.asm to EBP
	push 0x330A1F75                 ; hash("NTDLL.dll", "AdjustTokenPrivileges")
	call ebp                        ; hook("RtlSetDaclSecurityDescriptor")

x64 Hook code:

[BITS 64]
	
	cld                             ; Clear direction flags
	call get_hook_api               ; Get the address of inline_hook_api.asm to stack
	%include "inline_hook.asm"      ; inline_hook.asm goes here
get_hook_api:                       ; ...
	pop rbp                         ; Pop out the address of inline_hook_api.asm to EBP
	mov r10d,0x330A1F75             ; hash("ADVAPI32.dll", "AdjustTokenPrivileges")
	call rbp                        ; hook("RtlSetDaclSecurityDescriptor")