Remora Hook

[cyberbob]

hi,

I just open-sourced my tool: Remora Hook.

Win64 API monitor that hooks a target process using Export Address Table (EAT) and Import Address Table (IAT) patching -- no code modification on API bodies, no debugger attachment. Works with both normally compiled executables and heavily obfuscated, packed binaries with multiple unpacking layers, so you get a useful API log without fighting the protector first.

There is also a short demo GIF on the website showing it in action.

https://github.com/arkup/remora

[MarcElBichon]

Question about your ArkDasm here: https://forum.exetools.com/showthrea...e=2#post135940

[cyberbob]

Originally Posted by MarcElBichon

Question about your ArkDasm here: https://forum.exetools.com/showthrea...e=2#post135940

I'm not sure maybe I will continue from v1.1.0, improve the GUI a bit, and switch back to XED since its better suited for Intel code than Capstone.
v2.0 is missing debugger integration, so Ghidra is ahead there

[Fyyre]

Hey cyberbob,

I've been looking at Remora. The EAT/IAT + LdrLoadDll bootstrap is a nice way to get a usable API log off packed samples without fighting the protector first. The jail is the part that isn’t holding.

Want me to open issue on Github or contact you privately with findings?

-Fyyre

Originally Posted by cyberbob

hi,

I just open-sourced my tool: Remora Hook.

Win64 API monitor that hooks a target process using Export Address Table (EAT) and Import Address Table (IAT) patching -- no code modification on API bodies, no debugger attachment. Works with both normally compiled executables and heavily obfuscated, packed binaries with multiple unpacking layers, so you get a useful API log without fighting the protector first.

There is also a short demo GIF on the website showing it in action.

https://github.com/arkup/remora

[cyberbob]

Hi Fyyre,
Both options are fine, but maybe PM me your findings here first. I’m aware the jail system isn’t bulletproof, so perhaps I can tighten it up if it doesn’t affect compatibility, since getting the API logging working was my main priority.
Thanks

[Fyyre]

Certainly - let me organize everything and I'll DM you.

Originally Posted by cyberbob

Hi Fyyre,
Both options are fine, but maybe PM me your findings here first. I’m aware the jail system isn’t bulletproof, so perhaps I can tighten it up if it doesn’t affect compatibility, since getting the API logging working was my main priority.
Thanks