I'm looking for a tool that is able to check loaded module for any placed patches even on not exported functions.
I'm aware of Gmer, RKU and Co. and frankly I don't really trust their results.
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
HookShark is a great way of detecting whether anything has patched a process. In my experience it's mostly used when studying the stealth of game hacks.
HookShark is a detector of installed hooks and patches installed on the system (only usermode for now). It scans through the code-section of every loaded module of each running process and compares it with the file-image. If it detects discrepancies it tries to determine the type of hook or patch and reports it to the user.
Currently implemented hook detection:
* - Inline patches / Hooks (NOP, Exceptionhandler, relative Jumps, Custom patches)
* - Other custom patches [...]
* - VTable Hooks
* - IAT and EAT Hooks
* - Relocation Hooks
* - Hardware Breakpoints
* - PAGE_GAURD Candidates
The !chkimg extension detects corruption in the images of executable files by comparing them to the copy on a symbol store or other file repository.
HookShark will generate false positives in software that uses packer/cryptor to protect their code.