Even madExcept's .BPL module hooks (loaded by Delphi) are detected. Of course the purpose of such is a tool is simple, discovering existing hooks can help you diagnose your system, especially if you find instability between hooking packages or just want to know what process hooks what. I have not included any sort of "unhook" option in DbgHook, kX-Ray does this for any type of hook, kernel or user mode. I feel that in doing so I would be "working against" what Madshi has spent a lot of time developing so please do not ask me for such an option. If you absolutely need that option you can download my other program "kX-Ray".
I would appreciate any feedback if you find this utility useful. For best performance please run DbgHook.exe more than once, you'll find that after scanning one time, the second scan and any thereafter will be much faster. This week I plan to add support for IAT hook detection so I will post an updated build when I have the free time to do it. Email bindshell <at> gmail <dot> com for comments and/or bug reports.
Debug Hook v1.2
32-bit OS support only (at present)
2K, XP, 2K3, Vista
Debug Hook is Ring3 Code ONLY so it requires no driver. Do not let this fool you however, it doesn't use standard methods for enumerating processes, opening them or reading memory, all of these APIs are emulated and are part of my Symbiote Project.
*Vista users* You must right-click DbgHook.exe and choose "Run as Administrator" so that Debug Hook has sufficient access rights.
- Changed name of DbgHook to "PErvert" - PE Export Redirection VERification Tool
- View->"Clear" menu is now properly disabled when there are no entries in the listview
- File->"Save As HTML" menu is now properly disabled when there are no entries in the listview
- Added Export Address Table (EAT) hook detection
- Added "Scan" menu to listview popup menu
- Added "Analysis" tab to "Options->Settings" window for scan type selection
- Added "Type" listview column to show what type of hook was identified (EAT, Inline JMP [0x25FF, 0xE9, Push/Ret] etc.)
- Improved "Save As HTML" option so now only unique images are saved once, not the same one repeatedly as in v1.2
- Added total detected hook count column to status bar
- Fixed annoying cosmetic issue with horizontal scrollbar appearing in listview when it didn't need to be
My private copy also has IAT hook detection but I'm actually improving that (speed wise) so it didn't make this release, EAT is what a serious IAT patcher would also hook too which is detected in this build. I would appreciate any feedback.
Had a few spare minutes today for an update, so here it is.
- Added IAT (Import Address Table) Hook Detection
- Added Kernel Mode Driver Support for Opening Processes (admin rights needed for this option)
- Removed "Module Types" Tab from Settings
- Other Minor Engine Optimizations
Had a few spare minutes today and made a very minor update to Inline API Hook handling. I extended support for less common hook types which include these opcode instructions:
0x15FF absolute/indirect far call
0xEB jmp near rel8
0xEA jmp far imm32
Prior to this only the main 3 hook types were flagged which were 0xE9 relative jmp, 0x25FF absolute indirect far jmp and push/ret 0x68 <offs32> 0xC3. Enjoy!