Universal Hooker - Tool release
Hi,
I'm releasing a tool called 'Universal Hooker'. This version is
implemented as an ollydbg plugin.
The tool is available at http://oss.coresecurity.com/projects/uhooker.htm.
Documentation is available at
http://oss.coresecurity.com/uhooker/doc/index.html.
Any feedback is very welcome.
Here's a brief description of the tool:
The Universal Hooker is a tool to intercept execution of programs. It
enables the
user to intercept calls to API calls inside DLLs, and also arbitrary
addresses within the executable file in memory.
Why is it 'Universal'? There are different ways of hooking functions in
a program, for example,
it can be done by setting software breakpoints (int 3h), hardware
breakpoints (cpu regs), or overwriting
the prologue of a function to jump to a 'stub', etc. All the methods
mentioned above,
specially the latter, usually require the programmer of the code
creating the hook to have certain
knowledge of the function it is intercepting. If the code is written in a
programming language like C/C++, the code will normally need to be
recompiled for
every function one wants to intercept, etc.
The Universal Hooker tries to create very simple abstractions that allow
a user of the tool
to write hooks for different API and non-API functions using an
interpreted language (python),
without the need to compile anything, and with the possibility of
changing the code that gets executed
when the hooked function is called in run-time.
The Universal Hooker builds on the idea that the function handling the
hook is the one with
the knowledge about the parameters type of the function it is handling.
The Universal Hooker only
knows the number of parameters of the function, and obtains them from
the stack (all DWORDS). The hook handler
is the one that will interpret those DWORDS as the types received by the
function.
The hook handlers are written in python, what eliminates the need for
recompiling the handlers when a modification
is required. And also, the hook handlers (executed by the server) are
reloaded from disk every time a hook handler
is called, this means that one can change the behavior of the hook
handler without the need to recompile the code,
or having to restart the application being analyzed.
What can you do with it?
-fuzz in runtime without implementing protocol, just modify the packets
-interactive fuzzing using an hex editor :)
-poor's man http/https proxy
-Many things, check out the documentation :).
Thanks!
(please send feedback!)
--
Hernan Ochoa
Senior Security Consultant
Core Security Technologies
www.coresecurity.com