[Fyyre]

Hey cyberbob,

I've been looking at Remora. The EAT/IAT + LdrLoadDll bootstrap is a nice way to get a usable API log off packed samples without fighting the protector first. The jail is the part that isn’t holding.

Want me to open issue on Github or contact you privately with findings?

-Fyyre

Originally Posted by cyberbob

hi,

I just open-sourced my tool: Remora Hook.

Win64 API monitor that hooks a target process using Export Address Table (EAT) and Import Address Table (IAT) patching -- no code modification on API bodies, no debugger attachment. Works with both normally compiled executables and heavily obfuscated, packed binaries with multiple unpacking layers, so you get a useful API log without fighting the protector first.

There is also a short demo GIF on the website showing it in action.

https://github.com/arkup/remora