Skip to content

Instantly share code, notes, and snippets.

@c0d3inj3cT
Last active January 2, 2022 04:20
Show Gist options
  • Save c0d3inj3cT/7630602 to your computer and use it in GitHub Desktop.
Save c0d3inj3cT/7630602 to your computer and use it in GitHub Desktop.
This pintool was written to detect the API hooks by checking the calls to VirtualProtect() that mark the memory region of Win32 APIs as PAGE_EXECUTE_READWRITE. This method is often used in API hooking.
/*
Pintool to detect API hooks in a process
c0d3inj3cT
*/
#include <stdio.h>
#include <iostream>
#include "pin.H"
int i=0;
void VirtualProtectHandler(void *address, int newProtect)
{
if(newProtect == 0x40)
{
PIN_LockClient();
RTN lrtn = RTN_FindByAddress((ADDRINT) address);
if(RTN_Valid(lrtn))
{
i++;
string symbolName = RTN_Name(lrtn);
symbolName = PIN_UndecorateSymbolName(symbolName, UNDECORATION_COMPLETE);
printf("VirtualProtect(%p) ==> %s\n", address, symbolName.c_str());
}
PIN_UnlockClient();
}
}
void Image(IMG img, void *v)
{
RTN rtn = RTN_FindByName(img, "VirtualProtect");
if(RTN_Valid(rtn))
{
RTN_Open(rtn);
RTN_InsertCall(rtn, IPOINT_BEFORE, (AFUNPTR) VirtualProtectHandler, IARG_FUNCARG_ENTRYPOINT_VALUE, 0, IARG_FUNCARG_ENTRYPOINT_VALUE, 2, IARG_END);
RTN_Close(rtn);
}
}
void Fini(INT32 code, void *v)
{
printf("There are %d functions hooked\n", i);
}
INT32 Usage()
{
printf("There was an error\n");
return -1;
}
int main(int argc, char *argv[])
{
PIN_InitSymbols();
if( PIN_Init(argc,argv) )
{
return Usage();
}
IMG_AddInstrumentFunction(Image, 0);
PIN_AddFiniFunction(Fini, 0);
PIN_StartProgram();
return 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment