mike1k / hookhunter Goto Github PK

Would be interesting if you could diff every part of the process with the image on disk (for initialized sections at least), preferably with relocations filtered out

Would be nice to know what HookHunter explicitly looks for.
Just code patches? Or does it also look for IAT/EAT redirections too?
Can you list these in the README.md?

Also does it filter out relocations (from PE header IMAGE_DIRECTORY_ENTRY_BASERELOC section)? This is an issue if not.
For instance WKE (closed source) has a UM hook detection feature, but since it doesn't filter out relocations it literally spams the output Window to a stall. Then you have to filter by size to manually discern what might be an actual hook or not.