From Collaborative RCE Tool Library

Jump to: navigation, search

FastSystemCallHook

Tool name: FastSystemCallHook
Rating: 0.0 (0 votes)
Author: Darawk                        
Website: N/A
Current version:
Last updated: April 5, 2008
Direct D/L link: Locally archived copy
License type: Free / Open Source
Description: A snippet of code which is a KiFastSystemCall hook I wrote that hooks all user-mode APIs by replacing the SYSENTER MSR. It works also on multi-processor systems and should be easy to extend into a fully functional library if you want to.
Related URLs: No related URLs have been submitted for this tool yet


RSS feed Feed containing all updates for this tool.

Here below you will find useful notes about this tool, left by other users.

You are welcome to add your own useful notes here, or edit any existing notes to improve or extend them.

Only kernel mode not "all user-mode APIs"

Real neat, but IMHO you should edit to say "that hooks all user-mode APIs".."that enter kernel mode".. This is hooking only APIs that enter kernel mode. A lot, but certainly not "all" as there are many calls over the many Windowns APIs, that stay in user mode. And thus never go through "KiFastSystemCall()"

Retrieved from "http://www.woodmann.com/collaborative/tools/index.php/FastSystemCallHook"


If you find that any information for the tool above is missing, outdated or incorrect, please edit it!
(please also edit it if you think it fits well in some additional category, since this can also be controlled)

Views
Category Navigation Tree
RCE Tools
   Categorized by Target Type  (176)
   Categorized by Tool Type  (983)
   Anti Anti Test Tools  (15)
   Assemblers  (15)
   Code Coverage Tools  (12)
   Code Injection Tools  (32)
   Code Ripping Tools  (2)
   Crypto Tools  (5)
   Data Extraction Tools  (19)
   Debuggers  (42)
   Decompilers  (20)
   Deobfuscation Tools  (12)
   Dependency Analyzer Tools  (5)
   Diff Tools  (29)
   Disassemblers  (45)
   Dongle Analysis Tools  (24)
   Exe Analyzers  (31)
   Firefox Extensions  (1)
   GUI Manipulation Tools  (16)
   Hardware Reversing Tools  (24)
   Hex Editors  (12)
   IDA Signature Creation Tools  (5)
   Kernel Tools  (13)
   Memory Data Tracing Tools  (6)
   Memory Patchers  (3)
   Memory Search Tools  (7)
   Monitoring Tools  (110)
   API Monitoring Tools  (17)
   Active Directory Monitoring Tools  (1)
   Bus Monitoring Tools  (5)
   Debug Output Monitoring Tools  (1)
   Disk Monitoring Tools  (2)
   Driver & IRP Monitoring Tools  (1)
   Exception Monitoring Tools  (4)
   File Monitoring Tools  (4)
   Hook Detection Tools  (12)
   Install Monitoring Tools  (3)
   Kernel Filter Monitoring Tools  (1)
   Memory Data Tracing Tools  (6)
   Named Pipe Monitoring Tools  (1)
   Network Monitoring Tools  (7)
   Parallel Comm Monitoring Tools  (2)
   Process Monitoring Tools  (5)
   Registry Monitoring Tools  (6)
   Serial Comm Monitoring Tools  (1)
   SysCall Monitoring Tools  (5)
   Thread Monitoring Tools  (2)
   Tracers  (17)
   USB Monitoring Tools  (3)
   Window Monitoring Tools  (3)
   Network Tools  (15)
   PE Executable Editors  (79)
   .NET Executable Editors  (7)
   Code Injection Tools  (32)
   Executable CRC Calculators  (3)
   Export Editors  (2)
   Import Editors  (7)
   PE EXE Signature Tools  (2)
   Relocation Tools  (4)
   Resource Editors  (12)
   Packers  (16)
   Patch Packaging Tools  (7)
   Profiler Tools  (10)
   Programming Libraries  (32)
   Regular Expression Tools  (3)
   Resource Editors  (12)
   Reverse Engineering Frameworks  (7)
   Source Code Tools  (11)
   String Finders  (5)
   Symbol Tools  (11)
   System Information Extraction Tools  (7)
   Technical PoC Tools  (7)
   Test and Sandbox Environments  (16)
   Tool Extensions  (137)
   Tool Hiding Tools  (5)
   Tool Signatures  (22)
   Tracers  (17)
   Unpacking Tools  (59)
   Needs New Category  (2)