Comment % Stone's APIHook - Detector :)


	  Detecting an API-Spy real simple in a TASM/TLINK compiled program.
	  This program will detect any API spy that hooks MessageBoxA api
          by modifying the IAT. (Ofcause provided the HOOK doesn't come up
	  with counter meassures)....

	  NOTICE: THIS PROGRAM STRONGLY HINGES ON THE WAY BORLAND MAKES
          API-CALL'S... THE JUMP-TABLE APPROACH. NOTICE ALSO THAT IT HINGES
          ON THE "DETECT" CALL TO BE COMPILED AS A SHORT (RELATIVE CALL)...

 	  For a MS Convertion replace the first 4 lines of code with:
	  mov eax, dword ptr [Detection+2]
	  mov eax, [eax]
          ...
	  
          To change detection from the MessageBoxA api to another just change
          the call in detection accordingly.

				2nd&mi
				Stone / UCF & F4CG 1998
				email: stone@one.se
	%




.386P
Locals
jumps
.Model Flat ,StdCall
extrn VirtualQuery : PROC

UNICODE=0
include w32.inc
;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴
.Data  
Mem_Structure:
pvBaseAddress 	dd 0
pvAllocBase   	dd 0
dwAllocProt   	dd 0
dwRegionSize  	dd 0
dwState	      	dd 0
dwProtect	dd 0
dwType		dd 0 

lpUser32 	db "USER32.DLL",0
Tittle		db "Stone's ApiHook Detect",0
Detected	db 13,"                 FOUND!!",13,0
NotHere		db 13,"No ApiHook Installed on MessageBoxA",13,0
.Code                                  
;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴
Main:
	mov eax, dword ptr [Detection+1]	; Find IAT: 
						; eax = JMPtable-entry's displacement
						; from Detection
	add eax, offset Detection+5+2		; eax->IAT-Entry in jump instruction
						; E8(ADDRESS)=5, 2= FF25 of jump
	mov eax, [eax]				; eax->IAT-Entry

	mov eax, [eax]				; eax = IAT-entry

	call VirtualQuery, eax, offset Mem_Structure, 4*7 ; Which module owns this?

	call GetModuleHandleA, Offset lpUser32	; Get USER32's baseaddress
	cmp eax, [pvAllocBase]			; do they compare?
        jnz  SpyDetected

	call MessageBoxA, 0, offset NotHere, offset Tittle, 0
exit:
	Call ExitProcess, LARGE-1		

SpyDetected:
	call MessageBoxA, 0, offset Detected, offset Tittle, 0
	jmp  exit	

Detection:
	call MessageBoxA

;컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴
End Main
