Package rekall :: Package plugins :: Package windows :: Package malware :: Module apihooks :: Class HookHeuristic

Class HookHeuristic

A Hook heuristic detects possible hooks.

This heuristic emulates some common CPU instructions to try and detect control flow jumps within the first few instructions of a function.

These are essentially guesses based on the most common hook types. Be aware that these are pretty easy to defeat which will cause the hook to be missed.

See rekall/src/hooks/amd64.asm and rekall/src/hooks/i386.asm For the test cases which illustrate the type of hooks that we will detect.

Instance Methods

__init__(self, session=None)
x.__init__(...) initializes x; see help(type(x)) for signature

source code

Reset(self)

source code

WriteToOperand(self, operand, value)

source code

ReadFromOperand(self, operand)
Read the operand.

source code

process_lea(self, instruction)
Copies the address from the second operand to the first.

source code

process_push(self, instruction)

source code

process_pop(self, instruction)

source code

process_ret(self, _)

source code

process_mov(self, instruction)

source code

process_inc(self, instruction)

source code

process_dec(self, instruction)

source code

process_cmp(self, instruction)
We dont do anything with the comparison since we dont test for it.

source code

process_test(self, instruction)
We dont do anything with the comparison since we dont test for it.

source code

process_xor(self, instruction)

source code

process_add(self, instruction)

source code

process_sub(self, instruction)

source code

process_and(self, instruction)

source code

process_or(self, instruction)

source code

process_shl(self, instruction)

source code

process_shr(self, instruction)

source code

Inspect(self, function, instructions=10)
The main entry point to the Hook processor.

source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Properties
Inherited from `object`: `__class__`

Method Details

init(self, session=None)
(Constructor)

source code

x.__init__(...) initializes x; see help(type(x)) for signature

Overrides: object.__init__: (inherited documentation)

ReadFromOperand(self, operand)

source code

Read the operand.

We support the following forms:

- Immediate (IMM):  JMP 0x123456
- Absolute Memory Address (MEM): JMP [0x123456]
- Register (REG): JMP [EAX]

Inspect(self, function, instructions=10)

source code

The main entry point to the Hook processor.

We emulate the function instructions and try to determine the jump
destination.

Args:
   function: A basic.Function() instance.

Class HookHeuristic

__init__(self, session=None) (Constructor)

ReadFromOperand(self, operand)

Inspect(self, function, instructions=10)

init(self, session=None)
(Constructor)