Cheat Engine

dnsi0 · Posted: Tue Aug 19, 2008 1:54 pm Post subject: Hook scanner?

Is there a scanner to see what functions are hooked in kernel mode and defines what drivers were used?

DoomsDay · Posted: Tue Aug 19, 2008 2:18 pm Post subject:

rku
google it ^^

rapion124 · Posted: Tue Aug 19, 2008 7:58 pm Post subject:

Yes, you can make your own... Scan ntoskrnl.exe for jumps or calls (0xE9 or 0xE8). Determine the addresses of the calls and check if they are outside ntoskrnl.exe's address space (ModuleBase+ModuleSize). If they are, flag the address as a hook and attempt to resolve the function name. You could turn out false positives because sometimes, 0xE9/0xE9 might not be an instruction such as they are part of an address or a string.

dnsi0 · Posted: Wed Aug 20, 2008 9:35 am Post subject:

I didn't find that process in my process manager O.o

Zand · Posted: Wed Aug 20, 2008 9:56 am Post subject:

Flyte · Posted: Wed Aug 20, 2008 11:00 am Post subject:

samuri25404 · Posted: Wed Aug 20, 2008 2:33 pm Post subject:

rapion124 · Posted: Wed Aug 20, 2008 8:17 pm Post subject:

Sure, that might work. Scanning the beginning of an API for hardcoded values. It's a lot of work though. Truth is, there is no "perfect" method for finding hooks unless you manually look through the function. For example, checking for a jmp (0xE9) can easily be bypassed by using other mnemonics, like push address ,retn.