From Collaborative RCE Tool Library
HookShark
| Tool name: | HookShark |
|
||
|---|---|---|---|---|
| Author: | DeepBlueSea | |||
| Website: | http://forum.gamedeception.net/threads/20596-HookShark-BETA-0.9-(with-a-vengeance) | |||
| Current version: | BETA 0.9 | |||
| Last updated: | September 1, 2010 | |||
| Direct D/L link: | Locally archived copy | |||
| License type: | Free | |||
| Description: | HookShark is a detector of installed hooks and patches installed on the system (only usermode for now). It scans through the code-section of every loaded module of each running process and compares it with the file-image. If it detects discrepancies it tries to determine the type of hook or patch and reports it to the user. Currently implemented hook detection: * - Inline patches / Hooks (NOP, Exceptionhandler, relative Jumps, Custom patches) * - Other custom patches [...] * - VTable Hooks * - IAT and EAT Hooks * - Relocation Hooks * - Hardware Breakpoints * - PAGE_GAURD Candidates FAQ Why is IAT-Scanning / Hook-Scanning so slow? There are faster tools. ===================================================================== That's because other tools suck. They just walk the IAT Entrys and look for addresses that are out of the module bounds. Thats bollocks. The callback function of the hook, or a redirection (JMP) could be planted well within the module bounds, and there you have a stealth IAT Hook, which HookShark recognizes as "IAT - Local". And HookShark scans EVERY IAT-Table of EVERY Module. Unlike some other tools, which just examine the main process module. And HookShark does not only check for hooks in exported/known functions. No, byte by byte of disk/memory image is compared, and even one-byte-patches are revealed. That is only for read-only code-sections though. What the hell is all that crap? So many patches WTF? ====================================================== HookShark looks for differences between the disk image and the scanned memory. There might be cases where you are just looking at a packed module. To counter these false positives, there is an option to filter patches, which are bigger than n-bytes. (Look in the GlobalOptions Tab) Sometimes after i scanned a process and want to scan another one and it crashes. ================================================================================= Yeah, i hate when that happens. I have no idea why. If i get my lazy ass on the debugger i try to check it out. Until then, just restart HookShark. The mnemonics of patched instructions are wrongly displayed. ============================================================ That's because HookShark just cant do a thorough analysis like IDA does for every module in this short time-span. The alignment of instructions is guessed and heuristically computed. |
|||
| Related URLs: |
|
|||
| Screenshot: |
|---|
 |
Feed containing all updates for this tool.
Here below you will find useful notes about this tool, left by other users.
You are welcome to add your own useful notes here, or edit any existing notes to improve or extend them.
(please also edit it if you think it fits well in some additional category, since this can also be controlled)
Site has gone, and I can find no copy of the download to add here instead.
Do you know which version it was ? I found 0.5 on google.