#define RESOLVE_NOVERBOSE_UNHOOK(mod, func) RESOLVE_PARAMETERIZED(mod, func, false, true)
#define RESOLVE_NOVERBOSE_NOUNHOOK(mod, func) RESOLVE_PARAMETERIZED(mod, func, false, false) Resolver's constructor: ImportResolver( std::string dllName, std::string funcName, bool _verbose = false, bool _unhook = false, bool *_wasItHooked = nullptr ) "> template
ImportResolver(
std::string dllName,
std::string funcName,
bool _verbose = false,
bool _unhook = false,
bool *_wasItHooked = nullptr
)
How does it work?
The underlaying resolver leverages custom PE headers parser, that processes every referenced DLL module to map their exports and verify that module's PE headers integrity as well as integrity of referenced function's stub bytes. The idea is following: Firstly we issue LoadLibrary to load referenced by the user library (the one specified as first parameter for RESOLVE macro) if it could not be reached through GetModuleHandle. Then we process loaded/referenced library's PE headers, map its exports, retrieve array of exports addresses as well as compute these addresses ourselves for cross-verification. If address of a routine defined in DLL's Export Address Table doesn't correspond to what we would expect, the export is considered EAT hooked. The same goes if our Executable Import Address Table (IAT) entry for that function was altered and no longer points to the correct spot in DLL's code section - then the function is considered to be IAT hooked. Assuming no hooks were found so far, we fetch first N bytes of the function's prologue and compare them to what's in DLL's file stored in disk. If there is miscrepancy between bytes fetched from memory and from file - we consider function was inline patched (hot-patched). If the function was considered hooked - we return original export's address (the one we computed ourselves) and/or unhook the entry. If there were patch bytes in place, we'll restore them. Finally, in order to optimize resolver's performance (https://www.kitploit.com/search/label/Performance) impact - we cache all of the loaded modules imagebases and resolved functions addresses and return them from a cache (being std::map ) during subsequent hits. Among the problems such dynamically-unhooking resolver faced are the issues with traversing forwarded APIs (a DLL may contain Export thunk saying that this function is not implemented in this module, but it is in another one) - which although this implementation has support for, sometimes it brokes its traversal logic.
Author
Mariusz Banach / mgeeky (@mariuszbit)

Download UnhookMe (https://github.com/mgeeky/UnhookMe)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
UnhookMe - An Universal Windows API Resolver And Unhooker Addressing Problem Of Invoking Unmonitored System Calls From Within Of Your Red Teams Malware

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Cyber Security Due Diligence in M&A

https://cdn-images-1.medium.com/max/1024/1*47YmtlEgfBnM0l4aciTvTQ.jpeg
The mid and long-term effects of the pandemic on M&A

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hub Weekly Digest: US Labor Dept.,

https://cdn-images-1.medium.com/max/2600/1*YECeOxlko9KoOJNw8RNm3A.jpeg
HUB Security’s weekly digest covers top stories happening around the world related to cyber attacks, threats and global cybersecurity news.

Continue reading on HUB Security »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
HAWK — HackTheBox WriteUp

https://cdn-images-1.medium.com/max/725/1*urGTEQeRWqTiaMGPShf7Ig.png
This box is a part of TJnull’s list of boxes. I am doing these boxes as a part of my preparation for OSCP. I will be sharing the writeups…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
HackTheBox - SecNotes

https://cdn-images-1.medium.com/max/1190/0*lO8cU6k14uCS_nUI.png
Bu, OSCP için HackTheBox adında yayınlayacağım emekliye ayrılmış HTB makinelerinden oluşacak olan bir dizi blogun 3. blogu. TJ_Null…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Apron Network Supports Polkadot Ecosystem With Node Service
https://apron-network.medium.com/apron-network-supports-polkadot-ecosystem-with-node-service-9a4eb9823b5b?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

As of Q2 2021, we have more than 400 projects built on the Polkadot ecosystem, this was to occur with progress in the development of the…Continue reading on Medium » (https://apron-network.medium.com/apron-network-supports-polkadot-ecosystem-with-node-service-9a4eb9823b5b?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Where can I find the HDD-drive Conti leak?

( Catch-up: a disgrunteled affiliate of the Conti ransomware gang leaked some training materials)

Does anyone know the forum or the exact files? Is there a torrent for them? I am positivley DYING to see them and I am planning on translating them from russian to english with a buddy of mine. I have scoured the entire web for them, looked at so many forums, but I still cant find them.

submitted by /u/StillPackage4369
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

https://b.thumbs.redditmedia.com/QPt5XREyoQbIozGoUrJDk6vBjMG62XWcOu1vi63U06E.jpg submitted by /u/ITSGAMINGWEEEEEEK
[link] [comments]

hacking: security in practice
FREE Practical Ethical Hacking course from The Cyber Mentor

submitted by /u/FragileEagle
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Bug Hunting PhoenixRadioBali [ SQL Injection ]
https://medium.com/@joelaplnz/bug-hunting-phoenixradiobali-sql-injection-14b3fcad8391?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Helo semuanya, back lagi bersama saya, disini saya akan membahas kegiatan bug hunting yang saya lakukan beberapa hari belakangan ini pada…Continue reading on Medium » (https://medium.com/@joelaplnz/bug-hunting-phoenixradiobali-sql-injection-14b3fcad8391?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video