HookChain Documentation

HookChain is a technique designed to bypass Endpoint Detection and Response (EDR) systems by redirecting the execution flow of Windows subsystems. It achieves evasion by combining three specific techniques to remain invisible to EDRs that primarily monitor Ntdll.dll.

Core Components of the HookChain technique:

1. IAT Hooking: Modifying the Import Address Table to intercept function calls.
2. Dynamic SSN Resolution: Dynamically resolving System Service Numbers (SSNs).
3. Indirect System Calls: Using indirect syscalls to execute system functions without triggering standard EDR hooks in Ntdll.dll.

This approach allows for evasion without requiring modifications to the original source code of the applications or malware involved.

Detailed technical documentation and research regarding the HookChain technique can be found in the official white papers and the arXiv publication.

Available Resources:

• English White Paper (v1.5): Available on GitHub.
• English arXiv Paper: arXiv:2404.16856
• Portuguese White Paper (v1.5): Available on GitHub.

Before performing any injection or hooking operations, you must call InitApi() to prepare the HookChain environment. Failure to call this will result in initialization errors during subsequent operations.

if (!InitApi()) {
    printf("[!] Failed to initialize API\n");
    return 1;
}

Use SetDebug(BOOL) to control the verbosity of HookChain's internal logging. Passing FALSE will disable Hook prints, which is useful when performing silent injections.

// Disable Hook prints
SetDebug(FALSE);

HookChain provides HGetProcAddress2 to resolve the address of functions from specific modules. This is used to locate system APIs like MessageBoxW/MessageBoxA from User32.dll or TerminateThread from Kernel32.dll for use in shellcode.

// Example: Resolving MessageBoxW from User32
PVOID pfMessageBox = HGetProcAddress2("User32", "MessageBoxW");

The HookChain executable can be run via the command line. It accepts a Process ID (PID) as the first argument. If no argument is provided, the application will prompt the user to type the PID manually.

Usage:

# Provide PID as an argument
./HookChain <PID>

# Or run without arguments to be prompted
./HookChain