Quote:
Originally Posted by cyberbob
hi,
Win64 API monitor that hooks a target process using Export Address Table (EAT) and Import Address Table (IAT) patching -- no code modification on API bodies, no debugger attachment. Works with both normally compiled executables and heavily obfuscated, packed binaries with multiple unpacking layers, so you get a useful API log without fighting the protector first.
|
This sounds like a powerful setup. I'm particularly interested in how you're handling the bootstrap via LdrLoadDll.
Do you run into many issues with early-stage hooks before the IAT is fully populated in packed binaries?
The 'jail system' with pattern-based rules sounds incredibly useful for filtering out the noise in a busy API log. Are those rules defined in an external config file, or can you create them on the fly while monitoring? Also, are you planning to expand the monitored API list beyond the current 60?