> For the complete documentation index, see [llms.txt](https://easyauth.papelship.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://easyauth.papelship.com/csharp-document/other-func/hook-scanner.md).

# Hook Scanner

The Hook Scanner inspects system libraries and application modules for unauthorized inline hooks, trampoline jumps, import table modifications (IAT hooks), and export redirections (EAT hooks).

***

## Technical Mechanism

Malicious dynamic analysis tools, proxies, and game cheats often hook critical system APIs (such as `connect`, `send`, `recv`, `NtCreateThreadEx`, `VirtualProtect`) to inspect payloads or alter function return values.

The Hook Scanner performs:

{% stepper %}
{% step %}

## Clean Disk Image Comparison

Maps fresh copies of `ntdll.dll`, `kernel32.dll`, `user32.dll`, and `ws2_32.dll` directly from disk.
{% endstep %}

{% step %}

## Preamble Byte Disassembly

Disassembles the first 32 bytes of every exported API using an embedded lightweight disassembler (`ldasm`).
{% endstep %}

{% step %}

## Hook Detection

Identifies relative jumps (`0xE9`), indirect jumps (`0xFF 0x25`), push-ret sequences, and detours.
{% endstep %}

{% step %}

## IAT/EAT Integrity

Validates that all import address table entries point to authentic module memory boundaries.
{% endstep %}
{% endstepper %}

***

## C# Implementation

```csharp
using System;
using qPapelEasyAuth;

public class HookAudit
{
    public static void ScanSystemModules()
    {
        Console.WriteLine("[*] Running native API hook scan...");

        // Scans ntdll, kernel32, and ws2_32 for inline modifications
        int detectedHooks = qPapelEasyAuth.qPapelEasyAuth.ScanApiHooks();

        if (detectedHooks > 0)
        {
            Console.WriteLine($"[!] ALERT: {detectedHooks} unauthorized API hook(s) discovered in process!");
            qPapelEasyAuth.qPapelEasyAuth.ReportSuspicious($"Discovered {detectedHooks} hooks in memory", "hook_detected", "critical");
            Environment.Exit(0);
        }
        else
        {
            Console.WriteLine("[+] System Libraries: Clean (No inline hooks found).");
        }
    }
}
```

***

## Hook Types Detected

| Hook Pattern              | Typical Source                     | Severity |
| ------------------------- | ---------------------------------- | -------- |
| `0xE9 JMP <Rel32>`        | MinHook, Detours, Cheat Engine     | High     |
| `0xFF 0x25 JMP [RIP+Off]` | 64-bit Detours, API Monitor        | High     |
| `0xCC INT 3`              | Debuggers, Software Breakpoints    | Critical |
| `0x48 0xB8 ... 0xFF 0xE0` | Custom 64-bit Absolute Trampolines | High     |
| `IAT Modification`        | Process Hacker, DLL Injectors      | High     |

{% hint style="info" %}
When hooks are discovered on system DLLs, the engine can automatically unhook modified preambles by restoring clean bytes directly from the known-good image.
{% endhint %}