Remora Hook
 

hi,

I just open-sourced my tool: Remora Hook.

Win64 API monitor that hooks a target process using Export Address Table (EAT) and Import Address Table (IAT) patching -- no code modification on API bodies, no debugger attachment. Works with both normally compiled executables and heavily obfuscated, packed binaries with multiple unpacking layers, so you get a useful API log without fighting the protector first.

There is also a short demo GIF on the website showing it in action.

https://github.com/arkup/remora

Question about your ArkDasm here: https://forum.exetools.com/showthrea...e=2#post135940

I'm not sure maybe I will continue from v1.1.0, improve the GUI a bit, and switch back to XED since its better suited for Intel code than Capstone.
v2.0 is missing debugger integration, so Ghidra is ahead there

Hey cyberbob,

I've been looking at Remora. The EAT/IAT + LdrLoadDll bootstrap is a nice way to get a usable API log off packed samples without fighting the protector first. The jail is the part that isn’t holding.

Want me to open issue on Github or contact you privately with findings?

-Fyyre

Hi Fyyre,
Both options are fine, but maybe PM me your findings here first. I’m aware the jail system isn’t bulletproof, so perhaps I can tighten it up if it doesn’t affect compatibility, since getting the API logging working was my main priority.
Thanks

Certainly - let me organize everything and I'll DM you.

No, I had no issues with packed binaries in my tests. The released version is stable. If something didn’t work at first, I fixed it.

Sure, you can change the rules while the app is running, and the changes take effect right away. You can also save your API rules to a file using Config → Save Settings. The remora_config.ini file is created and loaded automatically when the app starts.

Its easy to add more APIs. The current list works for me, but if I notice something missing, I’ll add it.

Thank you. That clears up my doubts. I'll let you know if I run into any more issues.