Class CheckPEHooks

Determines if the address should be reported.

This assesses the destination address for suspiciousness. For example if the address resides in a VAD region which is not mapped by a dll then it might be suspicious.

Detect Import Address Table hooks.

An IAT hook is where malware changes the IAT entry for a dll after its loaded so that when it is called from within the DLL, flow control is directed to the malware instead.

We determine the IAT entry is hooked if the address is outside the dll which is imported.

Detect Export Address Table hooks.

An EAT hook is where malware changes the EAT entry for a dll after its loaded so that a new DLL wants to link against it, the new DLL will use the malware's function instead of the exporting DLL's function.

We determine the EAT entry is hooked if the address lies outside the exporting dll.

A Generator of hooked exported functions from this PE file.

Yields:
  A tuple of (function, name, jump_destination)

Collect data that will be passed to renderer.table_row.

Overrides: plugin.TypedProfileCommand.collect

(inherited documentation)

Overrides: plugin.Command.ImplementationByClass

Overrides: plugin.Command.ImplementationByName

table_header

hash(x)

Value:

[{'name': 'Type', 'width': 10}, {'name': 'source', 'width': 20}, {'name': 'target', 'width': 20}, {'name': 'source_func', 'width': 60}, {'name': 'target_func'}]