Thursday 31 July 2014

Dynamic Win32 API Call + Anti User-mode hooking [C#]

Posted By: Unknown - 06:53
When I was working with various user-mode hooking techniques, I developed this very simple way to bypass any trivial user-mode hooks applied to Win32 APIs.

Key features:
  • 32-bit and 64-bit support.
  • Bypasses trivial user-mode hooks at runtime (IAT,  Hotpatching, etc.)
  • Dynamically calls Win32 API by loading the library or module (if not already loaded) and getting the target function address at runtime.
To-do list / What doesn't work at the moment since I'm so lazy to implement it:
  • No support for Nt/Zw version APIs i.e. system calls. Don't use this to call them - unless you want your application to crash.
  • No support for functions not implementing the standard function prologue. (GetCurrentProcess, GetCurrentProcessId, etc.)


Here's the source code of the native DLL: Anti.cpp

Here's a simple wrapper class for using the DLL: DynamicApi.cs

Here's how you'd use it: SampleUsage.cs

Alright so, that's it for now. If you've any questions or suggestions, just leave them below in the comments section. Have fun! ;)

Copyright © 2013 Coding The Void™ is a registered trademark.

Designed by Templateism. Hosted on Blogger Platform.