├── Detector.sln ├── Detector ├── Detector.cpp ├── Detector.vcxproj ├── Detector.vcxproj.filters └── Detector.vcxproj.user ├── LICENSE └── README.md /Detector.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 17 4 | VisualStudioVersion = 17.4.33213.308 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Detector", "Detector\Detector.vcxproj", "{53AFDE73-5251-4FD0-B877-DBFB4F359128}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|x64 = Debug|x64 11 | Debug|x86 = Debug|x86 12 | Release|x64 = Release|x64 13 | Release|x86 = Release|x86 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {53AFDE73-5251-4FD0-B877-DBFB4F359128}.Debug|x64.ActiveCfg = Debug|x64 17 | {53AFDE73-5251-4FD0-B877-DBFB4F359128}.Debug|x64.Build.0 = Debug|x64 18 | {53AFDE73-5251-4FD0-B877-DBFB4F359128}.Debug|x86.ActiveCfg = Debug|Win32 19 | {53AFDE73-5251-4FD0-B877-DBFB4F359128}.Debug|x86.Build.0 = Debug|Win32 20 | {53AFDE73-5251-4FD0-B877-DBFB4F359128}.Release|x64.ActiveCfg = Release|x64 21 | {53AFDE73-5251-4FD0-B877-DBFB4F359128}.Release|x64.Build.0 = Release|x64 22 | {53AFDE73-5251-4FD0-B877-DBFB4F359128}.Release|x86.ActiveCfg = Release|Win32 23 | {53AFDE73-5251-4FD0-B877-DBFB4F359128}.Release|x86.Build.0 = Release|Win32 24 | EndGlobalSection 25 | GlobalSection(SolutionProperties) = preSolution 26 | HideSolutionNode = FALSE 27 | EndGlobalSection 28 | GlobalSection(ExtensibilityGlobals) = postSolution 29 | SolutionGuid = {74E5A3E4-26C0-4F93-A59E-8B704689D3F4} 30 | EndGlobalSection 31 | EndGlobal 32 | -------------------------------------------------------------------------------- /Detector/Detector.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | 5 | BOOL DetectHook(LPVOID hookedfuncaddr) { 6 | BYTE realbytes[] = "\x4C\x8B\xD1\xB8"; 7 | if (memcmp(realbytes, hookedfuncaddr, 4) == 0) { 8 | return true; 9 | } 10 | else { 11 | return false; 12 | } 13 | } 14 | 15 | void Banner() { 16 | printf(R"EOF( 17 | 18 | _ ___ ___ _ _ _ _ ___ _ _ 19 | /_\ | _ \_ _| | || |___ ___| |_(_)_ _ __ _ | \ ___| |_ ___ __| |_ ___ _ _ 20 | / _ \| _/| | | __ / _ \/ _ \ / / | ' \/ _` | | |) / -_) _/ -_) _| _/ _ \ '_| 21 | /_/ \_\_| |___| |_||_\___/\___/_\_\_|_||_\__, | |___/\___|\__\___\__|\__\___/_| 22 | |___/ 23 | 24 | [Coded by Brosck] 25 | [v2.0] 26 | 27 | )EOF"); 28 | } 29 | 30 | void Help(char* progname) { 31 | printf(R"EOF(usage: %s OUTPUT 32 | options: 33 | OUTPUT, output file 34 | )EOF", progname); 35 | } 36 | 37 | int main(int argc, char* argv[]) { 38 | bool hasHook = false; 39 | 40 | HMODULE ntdll = LoadLibraryA("ntdll.dll"); 41 | if (ntdll == NULL) { 42 | printf("[-] Error loading ntdll.dll\n"); 43 | return 1; 44 | } 45 | 46 | if (argv[1] == NULL) { 47 | Banner(); 48 | Help(argv[0]); 49 | return 1; 50 | } 51 | 52 | PIMAGE_DOS_HEADER dos_header = (PIMAGE_DOS_HEADER)ntdll; 53 | PIMAGE_NT_HEADERS nt_headers = (PIMAGE_NT_HEADERS)((char*)dos_header + dos_header->e_lfanew); 54 | PIMAGE_EXPORT_DIRECTORY exports = (PIMAGE_EXPORT_DIRECTORY)((char*)ntdll + nt_headers->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress); 55 | 56 | DWORD* function_names = (DWORD*)((char*)ntdll + exports->AddressOfNames); 57 | 58 | int outputfname = strlen(argv[1]) + 1; 59 | int wlen = MultiByteToWideChar(CP_UTF8, 0, argv[1], outputfname, NULL, 0); 60 | wchar_t* wdmpout = (wchar_t*)malloc(wlen * sizeof(wchar_t)); 61 | MultiByteToWideChar(CP_UTF8, 0, argv[1], outputfname, wdmpout, wlen); 62 | HANDLE outputf = CreateFileW(wdmpout, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL); 63 | char breakline[] = "\n"; 64 | 65 | Banner(); 66 | puts("[*] NT API being hooked:"); 67 | puts("========================================================================================="); 68 | for (int i = 0; i < exports->NumberOfFunctions; i++) { 69 | char* ntFunction = (char*)ntdll + function_names[i]; 70 | //printf("%s\n", ntFunction); 71 | if (strncmp(ntFunction, "Nt", 2) == 0) { 72 | if (strncmp(ntFunction, "NtdllDialogWndProc", 18) != 0 && strncmp(ntFunction, "NtdllDefWindowProc", 18) != 0) { // blacklist nt funcs 73 | FARPROC procaddr = GetProcAddress(ntdll, (LPCSTR)ntFunction); 74 | if (procaddr == NULL) { 75 | printf("[-] Error finding function %s\n", ntFunction); 76 | return 1; 77 | } 78 | LPBYTE lpprocaddr = (LPBYTE)procaddr; 79 | DWORD dwprocaddr = *(DWORD*)lpprocaddr; 80 | char realbytes[] = "0xB8D18B4C"; 81 | DWORD Written; 82 | 83 | if (strncmp(ntFunction, "NtQuerySystemTime", 17) == 0 && memcmp("\xE9\x4B", procaddr, 2) != 0) { 84 | hasHook = true; 85 | printf("[-] %s [%s != 0x%02X]\n", ntFunction, "0x****4BE9", dwprocaddr); 86 | WriteFile(outputf, ntFunction, strlen(ntFunction), &Written, NULL); 87 | WriteFile(outputf, breakline, strlen(breakline), &Written, NULL); 88 | } 89 | else if (strncmp(ntFunction, "NtGetTickCount", 14) == 0 && memcmp("\xB9\x20", procaddr, 2) != 0) { 90 | hasHook = true; 91 | printf("[-] %s [%s != 0x%02X]\n", ntFunction, "0x****20B9", dwprocaddr); 92 | WriteFile(outputf, ntFunction, strlen(ntFunction), &Written, NULL); 93 | WriteFile(outputf, breakline, strlen(breakline), &Written, NULL); 94 | } 95 | else if (strncmp(ntFunction, "NtQuerySystemTime", 17) != 0 && strncmp(ntFunction, "NtGetTickCount", 14) != 0 && !DetectHook(procaddr)) { 96 | hasHook = true; 97 | printf("[-] %s [%s != 0x%02X]\n", ntFunction, realbytes, dwprocaddr); 98 | WriteFile(outputf, ntFunction, strlen(ntFunction), &Written, NULL); 99 | WriteFile(outputf, breakline, strlen(breakline), &Written, NULL); 100 | } 101 | } 102 | } 103 | } 104 | 105 | if (!hasHook) { 106 | puts("[+] You are safe, there is no hook in the NT API"); 107 | } 108 | 109 | puts("========================================================================================="); 110 | 111 | CloseHandle(outputf); 112 | FreeLibrary(ntdll); 113 | return 0; 114 | } 115 | -------------------------------------------------------------------------------- /Detector/Detector.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | 16.0 23 | Win32Proj 24 | {53afde73-5251-4fd0-b877-dbfb4f359128} 25 | Detector 26 | 10.0 27 | 28 | 29 | 30 | Application 31 | true 32 | v143 33 | Unicode 34 | 35 | 36 | Application 37 | false 38 | v143 39 | true 40 | Unicode 41 | 42 | 43 | Application 44 | true 45 | v143 46 | Unicode 47 | 48 | 49 | Application 50 | false 51 | v143 52 | true 53 | Unicode 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | Level3 76 | true 77 | WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) 78 | true 79 | 80 | 81 | Console 82 | true 83 | 84 | 85 | 86 | 87 | Level3 88 | true 89 | true 90 | true 91 | WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 92 | true 93 | 94 | 95 | Console 96 | true 97 | true 98 | true 99 | 100 | 101 | 102 | 103 | Level3 104 | true 105 | _DEBUG;_CONSOLE;%(PreprocessorDefinitions) 106 | true 107 | 108 | 109 | Console 110 | true 111 | 112 | 113 | 114 | 115 | Level3 116 | true 117 | true 118 | true 119 | NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 120 | true 121 | 122 | 123 | Console 124 | true 125 | true 126 | true 127 | 128 | 129 | 130 | 131 | MultiThreaded 132 | 133 | 134 | 135 | 136 | 137 | -------------------------------------------------------------------------------- /Detector/Detector.vcxproj.filters: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | Arquivos de Origem 20 | 21 | 22 | -------------------------------------------------------------------------------- /Detector/Detector.vcxproj.user: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2023 MrEmpy 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # 「⚙️」API Hooking Detector 2 | Detect which native Windows API's (NtAPI) are being hooked 3 | 4 | ## Usage 5 | 6 | ``` 7 | PS C:> .\Detector.exe output.txt 8 | 9 | 10 | _ ___ ___ _ _ _ _ ___ _ _ 11 | /_\ | _ \_ _| | || |___ ___| |_(_)_ _ __ _ | \ ___| |_ ___ __| |_ ___ _ _ 12 | / _ \| _/| | | __ / _ \/ _ \ / / | ' \/ _` | | |) / -_) _/ -_) _| _/ _ \ '_| 13 | /_/ \_\_| |___| |_||_\___/\___/_\_\_|_||_\__, | |___/\___|\__\___\__|\__\___/_| 14 | |___/ 15 | 16 | [Coded by brosck] 17 | [v2.0] 18 | 19 | [*] NT API being hooked: 20 | ========================================================================================= 21 | [+] You are safe, there is no hook in the NT API 22 | ========================================================================================= 23 | ``` 24 | --------------------------------------------------------------------------------