Remora Hook

[cyberbob]

hi,

I just open-sourced my tool: Remora Hook.

Win64 API monitor that hooks a target process using Export Address Table (EAT) and Import Address Table (IAT) patching -- no code modification on API bodies, no debugger attachment. Works with both normally compiled executables and heavily obfuscated, packed binaries with multiple unpacking layers, so you get a useful API log without fighting the protector first.

There is also a short demo GIF on the website showing it in action.

https://github.com/arkup/remora

[MarcElBichon]

Question about your ArkDasm here: https://forum.exetools.com/showthrea...e=2#post135940

[cyberbob]

Originally Posted by MarcElBichon

Question about your ArkDasm here: https://forum.exetools.com/showthrea...e=2#post135940

I'm not sure maybe I will continue from v1.1.0, improve the GUI a bit, and switch back to XED since its better suited for Intel code than Capstone.
v2.0 is missing debugger integration, so Ghidra is ahead there