[MASM] Self IAT Hook

[DataBus]

Here is a tutorial on how to do a self IAT hook
It's great for learning experiences

  
.486 ;use the 80486 instruction set
.model flat, stdcall ;flat memory __stdcall convention
option casemap:none ;case sensitivity
 
include windows.inc
include kernel32.inc
include user32.inc
includelib kernel32.lib
includelib user32.lib
 
extern _imp__GetModuleHandleA@4 :DWORD
GetModuleHandle equ _imp__GetModuleHandleA@4
 
.data
EP  db 'ExitProcess', 00h
K32 db 'Kernel32.dll', 00h
BB  db 'Exiting...', 00h
 
.data?
hInstance DWORD ?
 
.code
 
myExit: ;this is what will be replaced with ExitProcess
 
    push 0
    push 0
    push offset BB
    push 0
    call MessageBox
 
    push offset K32
    call GetModuleHandle
    push offset EP
    push eax
    call GetProcAddress    
    call eax
    
    retn
 
WriteDWORD proc uses EAX EBX lpAddress:DWORD, lpWrite:DWORD
LOCAL dwOldProtect: DWORD
    push dwOldProtect
    push PAGE_EXECUTE_READWRITE
    push 5
    push lpAddress
    call VirtualProtect ;now we can write memory
    
    mov ebx, lpAddress ;ebx = target
    mov eax, lpWrite ;eax = write
    mov [ebx], eax ; mov eax into dword ptr ebx 
    
    push dwOldProtect
    push dwOldProtect
    push 5
    push lpAddress
    call VirtualProtect ;set it back
    
    retn
WriteDWORD EndP
 
GetIAT proc uses EBX
    push NULL
    call GetModuleHandle ;get our module
    mov ebx, eax ;put it into ebx
    add ebx, [ebx+3Ch] ;point to PE
    assume ebx : ptr IMAGE_NT_HEADERS32 ;self explanitory
    mov ebx, [ebx].OptionalHeader.DataDirectory[1*8].VirtualAddress    ;pointing to it now
    add ebx, eax ;add our base to the address
    mov eax, ebx ;mov it into eax
    sub eax, 1Ch ;point to exitprocess
    pop ebx
    retn
GetIAT EndP
 
start:
    call GetIAT ;get our hook addr
    mov ebx, offset myExit    ;replace it with this
    push ebx 
    push eax
    call WriteDWORD    ;write it
    
@Exit:
    push 0
    call ExitProcess ;now we exit and our hooked exit it called
end start 
  

Sorry if this tutorial is not good, English is my first language but I'm a crappy teacher!

IAT - > Addresses

Opcode calls address from IAT, what we are doing is getting IAT and making it point to a different function

you can also make dll files like this, but with memorymapping of course

hope you enjoyed my tutorial!

[billybombill]

Lol DataBus your on a roll today ;]