UnhookMe - UnhookMe is an universal Windows API resolver & un

项目说明

UnhookMe - Dynamically unhooking imports resolver

In the era of intrusive AVs and EDRs that introduce hot-patches to the running processes for their enhanced optics requirements, modern ad must have a robust tool to slide through these watchguards. The propsed implementation of dynamic imports resolver that would be capable of unhooking used functions in-the-fly is yet another step towards strengthening ad resilience efforts.

The solution I'm proposing here is to switch from using linker-resol imports, staying in compiled executable's PE headers (Import Address Table specifically) to fa approach insisting on resolving imports only in a dynamic fashion. Such dynamical resolver can be equipped with unhooking logic happening in the background, without any sort of guidance from the operator's side.

---

Simplest usage example

This is how you can ensure to call MessageBoxW unhooked, unmonitored:

All the magic happens within RESOLVE macrodefintion, that constructs ImportResolver<T> object named _MessageBoxW.

---

Showcase

!Unhookme showcase animation

Here's how UnhookMe example works:

1. It presents us with the first MessageBoxW that is not subject for hooking
2. Then we hook MessageBoxW prologue ourselves to make it always return 0 without displaying it's message
3. Finally, we resolve MessageBoxW dynamically using the UnhookingImportResolver resolver, which will detect
applied prologue patches and restore original bytes, effectively unhooking MessageBoxW functionality.

In the meantime of popping message boxes, these are the loglines printed to console's stdout:

---

How to use it?

There are in total 5 C++ source code/header files that your solution need to include. However your main program file needs to include only two required headers, as detailed below.

* resolver.h - header containing most of the UnhookingImportResolver implementation and handy macrodefinitions
* resolver.cpp - source code with global options defined
* usings.h - a one big and nasty header file containing tens of using type definitions for commonly used WinAPIs
* PE.cpp - custom PE parser source code file
* PE.h - custom PE parser header file

Required headers

Your program will require only two headers being included:

Global options

There are couple of global options that can be changed affecting the way in which Resol or reports it's activity. These are defined in the very beginning of resolver.cpp file:

Resol options:

Custom API type specification

In order to use Resolver a function pointer type must be first declared with using statement of strict form:

This repository comes with usings.h header file containing predefined using types for tens of popular Windows APIs.

The _FunctionName_ will correspond to the WinAPI that we want to ha resolve and that function pointer must be marked as having WINAPI call con ( __stdcall on x86 and __fastcall on x64). The _ReturnType_ must precede WINAPI type modifier.

Function resolution and usage

Having function pointer type defined like specified above, we will be able to use it in the following manner:

The macro RESOLVE takes care of instantiating ImportResolver templated object and adjust specifed library's name.

Resol several more Macrodefinitions offering easy to use in circumstances constructor in:

Resolver's constructor:

---

How does it work?

The underlaying resol custom PE headers parser, that processes every referenced DLL module to map their exports and that module's PE headers integrity as well as integrity of referenced function's stub bytes.

The idea is following:

1) Firstly we issue LoadLibrary to load referenced by the user library (the one specified as first parameter for RESOLVE macro) if it could not be reached through GetModuleHandle.

2) Then we process loaded/referenced library's PE headers, map its exports, retrie of exports addresses as well as compute these addresses ourselves for cross-.

3) If address of a routine defined in DLL's Export Address Table doesn't correspond to what we would expect, the export is considered EAT hooked. The same goes if our Executable Import Address Table (IAT) entry for that function was altered and no longer points to the correct spot in DLL's code section - then the function is considered to be IAT hooked.

4) Assuming no hooks were found so far, we fetch first N bytes of the function's prologue and compare them to what's in DLL's file stored in disk. If there is miscrepancy between bytes fetched from memory and from file - we consider function was inline patched (hot-patched).

5) If the function was considered hooked - we return original export's address (the one we computed ourselves) and/or unhook the entry. If there were patch bytes in place, we'll restore them.

6) Finally, in order to optimize resolver's performance impact - we cache all of the loaded modules imagebases and resol addresses and return them from a cache (being std::map ) during subsequent hits.

Among the problems such dynamically-unhooking resol are the issues with tra forwarded APIs (a DLL may contain Export thunk saying that this function is not implemented in this module, but it is in another one) - which although this implementation has support for, sometimes it brokes its tra logic.

---

☕ Show Support ☕

This and other projects are outcome of sleepless nights and plenty of hard work. If you like what I do and appreciate that I always give back to the community,
Consider buying me a coffee _(or better a beer)_ just to say thank you! 💪

---

Author

项目信息

开发语言：C++

Star 数：347

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕UnhookMe is an universal Windows API resolver & unhooker addressing problem of invoking unmonitored system calls from within of your Red Teams malware展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。