Remora Hook

[cyberbob]

hi,

I just open-sourced my tool: Remora Hook.

Win64 API monitor that hooks a target process using Export Address Table (EAT) and Import Address Table (IAT) patching -- no code modification on API bodies, no debugger attachment. Works with both normally compiled executables and heavily obfuscated, packed binaries with multiple unpacking layers, so you get a useful API log without fighting the protector first.

There is also a short demo GIF on the website showing it in action.

https://github.com/arkup/remora

[MarcElBichon]

Question about your ArkDasm here: https://forum.exetools.com/showthrea...e=2#post135940

[cyberbob]

Originally Posted by MarcElBichon

Question about your ArkDasm here: https://forum.exetools.com/showthrea...e=2#post135940

I'm not sure maybe I will continue from v1.1.0, improve the GUI a bit, and switch back to XED since its better suited for Intel code than Capstone.
v2.0 is missing debugger integration, so Ghidra is ahead there

[Fyyre]

Hey cyberbob,

I've been looking at Remora. The EAT/IAT + LdrLoadDll bootstrap is a nice way to get a usable API log off packed samples without fighting the protector first. The jail is the part that isn’t holding.

Want me to open issue on Github or contact you privately with findings?

-Fyyre

Originally Posted by cyberbob

hi,

I just open-sourced my tool: Remora Hook.

Win64 API monitor that hooks a target process using Export Address Table (EAT) and Import Address Table (IAT) patching -- no code modification on API bodies, no debugger attachment. Works with both normally compiled executables and heavily obfuscated, packed binaries with multiple unpacking layers, so you get a useful API log without fighting the protector first.

There is also a short demo GIF on the website showing it in action.

https://github.com/arkup/remora

[cyberbob]

Hi Fyyre,
Both options are fine, but maybe PM me your findings here first. I’m aware the jail system isn’t bulletproof, so perhaps I can tighten it up if it doesn’t affect compatibility, since getting the API logging working was my main priority.
Thanks

[Fyyre]

Certainly - let me organize everything and I'll DM you.

Originally Posted by cyberbob

Hi Fyyre,
Both options are fine, but maybe PM me your findings here first. I’m aware the jail system isn’t bulletproof, so perhaps I can tighten it up if it doesn’t affect compatibility, since getting the API logging working was my main priority.
Thanks

[Ibrahim_Mihai]

Originally Posted by cyberbob

hi,



Win64 API monitor that hooks a target process using Export Address Table (EAT) and Import Address Table (IAT) patching -- no code modification on API bodies, no debugger attachment. Works with both normally compiled executables and heavily obfuscated, packed binaries with multiple unpacking layers, so you get a useful API log without fighting the protector first.

This sounds like a powerful setup. I'm particularly interested in how you're handling the bootstrap via LdrLoadDll.
Do you run into many issues with early-stage hooks before the IAT is fully populated in packed binaries?
The 'jail system' with pattern-based rules sounds incredibly useful for filtering out the noise in a busy API log. Are those rules defined in an external config file, or can you create them on the fly while monitoring? Also, are you planning to expand the monitored API list beyond the current 60?

[cyberbob]

No, I had no issues with packed binaries in my tests. The released version is stable. If something didn’t work at first, I fixed it.

Sure, you can change the rules while the app is running, and the changes take effect right away. You can also save your API rules to a file using Config → Save Settings. The remora_config.ini file is created and loaded automatically when the app starts.

Its easy to add more APIs. The current list works for me, but if I notice something missing, I’ll add it.

[Ibrahim_Mihai]

Originally Posted by cyberbob

No, I had no issues with packed binaries in my tests. The released version is stable. If something didn’t work at first, I fixed it.

Sure, you can change the rules while the app is running, and the changes take effect right away. You can also save your API rules to a file using Config → Save Settings. The remora_config.ini file is created and loaded automatically when the app starts.

Its easy to add more APIs. The current list works for me, but if I notice something missing, I’ll add it.

Thank you. That clears up my doubts. I'll let you know if I run into any more issues.