Ви не можете вибрати більше 25 тем Теми мають розпочинатися з літери або цифри, можуть містити дефіси (-) і не повинні перевищувати 35 символів.

4 роки тому
1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071
  1. ---
  2. title: "Hooking Engine Deatmatch"
  3. description: "Evaluating various hooking engines, putting them against pathologically hard to hook functions"
  4. date: 2020-02-26T22:00:00+01:00
  5. draft: false
  6. ---
  7. For the full code see the [git repo](https://vcs.wacked.codes/wacked/hook_tests).
  8. Introduction
  9. ============
  10. This project aims to give a simple overview on how good various x64 hooking
  11. engines (on windows) are. I'll try to write various functions, that are hard to
  12. patch and then see how each hooking engine does.
  13. I'll test:
  14. * [EasyHook](https://easyhook.github.io/)
  15. * [PolyHook](https://github.com/stevemk14ebr/PolyHook)
  16. * [MinHook](https://www.codeproject.com/Articles/44326/MinHook-The-Minimalistic-x-x-API-Hooking-Libra)
  17. * [Mhook](http://codefromthe70s.org/mhook24.aspx)
  18. (I'd like to test detours, but I'm not willing to pay for it. So that isn't
  19. tested :( )
  20. There are multiple things that make hooking difficult. Maybe you want to patch
  21. while the application is running -- in that case you might get race conditions,
  22. as the application is executing your half finished hook. Maybe the software has
  23. some self protection features (or other software on the system provides that,
  24. e.g. Trustee Rapport)
  25. Evaluating how the hooking engines stack up against that is not the goal here.
  26. Neither are non-functional criteria, like how fast it is or how much memory it
  27. needs for each hook. This is just about the challenges the function to be
  28. hooked itself poses.
  29. Namely:
  30. * Are jumps relocated?
  31. * What about RIP adressing?
  32. * If there's a loop at the beginning / if it's a tail recurisve function, does
  33. the hooking engine handle it?
  34. * How good is the dissassembler, how many instructions does it know?
  35. * Can it hook already hooked functions?
  36. At first I will give a short walk through of the architecture, then quickly go
  37. over the test cases. After that come the results and an evaluation for each
  38. engine.
  39. I think I found a flaw in all of them; I'll publish a small POC which should at
  40. least detect the existence of problematic code.
  41. **A word of caution**: my results are worse than expected, so do assume I have
  42. made a mistake in using the libraries. I went into this expecting that some
  43. engines at least would try to detect e.g. the loops back into the first few
  44. bytes. But none did? That's gotta be wrong.
  45. **Another word of caution**: parts of this are rushed and/or ugly. Please
  46. double check parts that seem suspicious. And I'd love to get patches, even for
  47. the most trivial things -- spelling mistakes? Yes please.
  48. Result
  49. ========
  50. | Name|Small|Branch|RIP Relative|AVX|RDRAND|Loop|TailRec|
  51. |----------|-----|------|------------|---|------|----|-------|
  52. | PolyHook| X | X | X | X | | | |
  53. | MinHook| X | X | X | | | | X |
  54. | MHook| | | X | | | | |