Ran hook_finder64.exe on carbon black on 02 Feb 2022, updated the list for carbon black

Raw result below: https://gist.github.com/ScriptIdiot/57886fd8b556b128aa0b70b38bb1f628

Hello,

This code detects hooks in the Import Address Table and replace the hooks with the true address of the functions.

I thought it could be usefull in this repo :)

I've modified some variable type and function in order to be able to compile and execute the code on my machine. This version is working perfectly. Maybe other people hadthe same issue ?

For instance "GetBytesByName" was a bool but returned nothing (compilation error). "OffsetNamesTable" variable was a DWORD* leading to a compilation error during the operation base + OffsetNamesTableOffset (compilation error)

Made a simple parser that takes all the TXT files in current directory, and parses it into a CSV format.

Usage: Python3 Parse.py > out.csv

Then you can Excel it, or change to Markdown easier.

Full output as below:

Loading C:\windows\system32\ntdll.dll HookFinder Mr.Un1k0d3r RingZer0 Team Listing loaded modules

C:\Users\lowprivuser\Desktop\hook_finder64.exe is loaded at 0x0000000000400000. C:\Windows\SYSTEM32\ntdll.dll is loaded at 0x00007FFE428B0000. C:\Windows\System32\KERNEL32.DLL is loaded at 0x00007FFE41020000. C:\Windows\System32\KERNELBASE.dll is loaded at 0x00007FFE3FEF0000. C:\Windows\SYSTEM32\apphelp.dll is loaded at 0x00007FFE3DFB0000. C:\Windows\System32\msvcrt.dll is loaded at 0x00007FFE412A0000. **Listing Nt API only

NtQuerySystemTime is hooked

Completed

Hi,

wanted to share my observation for Kaspersky. Seems like Kaspersky does the real hooking in Kernel mode as well like Cortex or Defender MDE.

How can those hooks be identified?

Loading c:\Windows\System32\ntdll.dll
HookFinder Mr.Un1k0d3r RingZer0 Team
Listing loaded modules
------------------------------------------
C:\Users\user\Desktop\hook_finder64.exe is loaded at 0x0000000000400000.
C:\Windows\SYSTEM32\ntdll.dll is loaded at 0x00007FFF0C150000.
C:\Windows\System32\KERNEL32.DLL is loaded at 0x00007FFF0BBF0000.
C:\Windows\System32\KERNELBASE.dll is loaded at 0x00007FFF09A90000.
C:\Windows\System32\msvcrt.dll is loaded at 0x00007FFF0BDE0000.
***Listing Nt* API only

NtQuerySystemTime is hooked
------------------------------------------
Completed

Some functions are hooked from user-mode, but it seems the DLL is not injected in all processes. Some are with a JMP instruction, for example NtAllocateVirtualMemory:

Others are hooked using a PUSH; RET approach, for example NtMapViewOfSection

I've added some comment to clarify the code and replace the 4096 bytes size in virtual protect to 8 bytes. Because well, 4096 was maybe a little overkill...

I tried against a few more like Fireeye EDR in windows 7 but you hook detector did not like it. I also tried it against cybereason, F-Secure EDRs but hook detector did not like windows server versions either.

Loading C:\windows\system32\ntdll.dll
HookFinder Mr.Un1k0d3r RingZer0 Team
------------------------------------------
BASE                    0x00007FF8BC940000      MZÉ
PE                      0x00007FF8BC9400D8      PE
ExportTableOffset       0x00007FF8BCA8C370
OffsetNameTable         0x00007FF8BCA8E8CC
Functions Count         0x94d (2381)
------------------------------------------
RtlInitializeSListHead is hooked
------------------------------------------
Completed

You may want to include Tanium advance EDR solution. Being used by big organizations and to address insider threat.

https://try.tanium.com/?utm_campaign=01-D-PSP-OA-PPC-WW-Google-HFPOC&utm_source=google&utm_medium=cpc&utm_content=tanium&utm_term=%2Btanium&gclid=Cj0KCQjws-OEBhCkARIsAPhOkIad-9DIv8SBZfxq8o_vf7PSq2BOZctqNyFP630UmMY87HZm56n-gVQaAt5fEALw_wcB

Wanted to share that Microsoft Defender for Endpoint (MDE) (previously known as Advanced Threat Protection (ATP)) is embedded within the operating system and does not seem to hook anything on ntdll.dll. Perhaps you might want to add that to the list despite the empty output.