rad9800/vehapiresolveResolves Windows APIs at runtime using vectored exception handlers and hashed lookups to hide imports and slow reverse engineering of offensive payloads.
Inspired by Dridex Loader's 32 bit API obfuscation.
We setup an exception handler.
AddVectoredExceptionHandler( CALL_FIRST, ApiResolverHandler );
This exception handler will only handle exception's thrown as EXCEPTION_BREAKPOINT. When it is thrown by us, we're able to capture the CONTEXT. We can get the arguments passed.
RDX and R8 will hold our function and module hash. We can then dynamically resolve them with GetProcAddrExH as seen
ExceptionInfo->ContextRecord->Rax = (ULONG_PTR)GetProcAddrExH( ExceptionInfo->ContextRecord->Rdx, ExceptionInfo->ContextRecord->R8 );
The RAX is often used to return values. When we return, if the address was resolved, it'll be returned.
LazyRet proc
int 3 ; raise an exception
ret ; rax will hold address
LazyRet endp
We can then use this address.
Probably makes a reverse engineers life harder, which is always good.