Functions — github.com/Signal-Labs/iat_unhook_sample

CodeHub MCPcopy Create free account

hub / github.com/Signal-Labs/iat_unhook_sample / functions

Functions41 in github.com/Signal-Labs/iat_unhook_sample

⨍ Functions 41 ◇ Types & classes 37

↓ 14 callersMethodget

(&self, base_address: usize)

src/pe_def.rs:617

↓ 11 callersFunctionget_module_by_name

Finds a [`ModuleHandle`] in the PEB that matches the provided name. Returns a handle to the module if found, otherwise returns None.

src/pe_helper.rs:832

↓ 7 callersMethodget_base_address

Returns the base field of the module.

src/pe_helper.rs:962

↓ 7 callersMethodget_data_directories

src/pe_def.rs:15

↓ 6 callersMethodparse_pe

Parses the pe file represented by this module, stores the result in the associated pe variable and returns a result

src/pe_helper.rs:998

↓ 5 callersMethodget_size

Returns the size field of the module

src/pe_helper.rs:966

↓ 4 callersMethodget_export_address_table_entry

Get an entry from the export_address_table_rva by obtaining the underlying ExportAddressTable and indexing into it with the provided index, checking t

src/pe_def.rs:356

↓ 4 callersMethodget_export_table

Gets the entry corresponding to the export table

src/pe_def.rs:133

↓ 3 callersMethodget_export_name_ptr_table_entry

Enumerates the ExportNamePtrTable looking for a String match with the provided name, gets the ExportNamePtrTable using the provided base_address, simi

src/pe_def.rs:390

↓ 3 callersMethodget_export_ordinal_table_entry

Gets an entry from the ExportOrdinalTable, similar to how we get entries from the ExportAddressTable

src/pe_def.rs:374

↓ 3 callersFunctionget_peb

src/pe_helper.rs:924

↓ 3 callersMethodis_pe_parsed

Checks if the pe field is populated and returns a result with errors if the pe field is not populated, or if the lock failed to be obtained

src/pe_helper.rs:1061

↓ 3 callersFunctionunhook_iat_entry

Takes an iat_entry, disassembles the target function to determine if its hooked, if it is, it will unhook it and return Ok(true), if it is not hooked,

src/pe_helper.rs:161

↓ 2 callersMethodextract_string

Convert the buffer to a utf16 string based on the length field

src/pe_def.rs:632

↓ 2 callersFunctionget_export_table

Returns an array of function pointers for a module's export table

src/pe_helper.rs:734

↓ 2 callersFunctionget_proc_address

Custom GetProcAddress implementation by parsing the export directory table of a PE64 module

src/pe_helper.rs:766

↓ 2 callersMethodis_valid

src/pe_def.rs:44

↓ 2 callersMethodis_within_range

( &self, target_type: ImageDataDirectoryEntry, address: usize, )

src/pe_def.rs:218

↓ 2 callersMethodlen

Enumerates the bytes of the string until it finds a null byte, returns the length. We manually count the bytes as the type has no associated size info

src/pe_def.rs:332

↓ 2 callersMethodto_string

Converts the ASCIIString to a Rust String

src/pe_def.rs:342

↓ 2 callersFunctionunpatch_iat_hooks

Attempts to unhook the IAT of the current process, returns Ok(true) if successful, Ok(false) if no hooks were detected, or Err if an error occurred.

src/pe_helper.rs:68

↓ 1 callersFunctioncontains_ntdll_jmp

( displacement: u64, ntdll_start: u64, ntdll_end: u64, addr_list: &Vec<usize>, )

src/pe_helper.rs:647

↓ 1 callersMethodget_export_addr_from_name

(&self, target_str: &str)

src/pe_helper.rs:969

↓ 1 callersMethodget_import_address_table

Gets the entry corresponding to the import table

src/pe_def.rs:171

↓ 1 callersMethodget_import_lookup_table

src/pe_def.rs:151

↓ 1 callersFunctionget_module_by_address

Finds a [`ModuleHandle`] in the PEB that matches the provided base address. Returns a handle to the module if found, otherwise returns None.

src/pe_helper.rs:879

↓ 1 callersMethodget_nt_headers

src/pe_def.rs:28

↓ 1 callersFunctionget_vprotect_addr

Attempts to get the unhooked start address of VirtualProtect

src/pe_helper.rs:134

↓ 1 callersFunctionunpatch_single

Attempts to unhook a single address, if hooked

src/pe_helper.rs:49

Methodfrom_index

src/pe_def.rs:453

Returns the name of the module.

src/pe_helper.rs:954

Functionget_ntdll_ntopenfile_function

src/pe_helper.rs:1116

Gets the internal PE

src/pe_helper.rs:958

Tests unhooking NTDLL, expected to be launched with an attached debugger to catch the int3's and see the difference in behavior between the first exec

Functiontest_get_module_by_name

src/pe_helper.rs:1081

Functiontest_get_module_by_name_ref_count

src/pe_helper.rs:1087

Functiontest_get_peb

src/pe_helper.rs:1074

Functiontest_get_proc_address

src/pe_helper.rs:1150

Functiontest_parse_pe

src/pe_helper.rs:1102

Functionunhook_exports

Unhooks via disassembling each exported function and patching any identified jmps directly at the function's start, this enables unhooking of function

Functionunhook_iat

Attempts to unhook the IAT of the current process, returns true if hooks were patched, or false if there were no hooks or an error occurred