How to use HAM? | Hexacorn

This is a short intro tutorial on how to use HAM. The basic idea is to show how to:

So, let’s begin:

First, download and run HAM. You should see the following screen:
Now, Press F3, Ctrl-O, or choose File->Open Executable from the application menu.
Go to your System Directory:
Type ‘notepad.exe‘ and hit Enter
Type the command line argument for Notepad e.g. ‘test.txt‘ – this file will be opened by Notepad:
Press Alt+A or click the icon as shown below:
Choose ‘CreateFileW‘ API in the API Functions window:
Press F5 or click the icon as shown below:
The Notepad will now be launched, modules loaded by Notepad will be shown in a small window; for each module loaded, HAM will attempt to intercept all APIs as selected earlier in the API Functions – in our case it is only ‘CreateFileW’ :
Each module loaded by Notepad is shown in the output pane; Notepad window is shown on the Desktop as well; as you can see, CreateFileW API has been called once, and with the argument being a file name that we typed in Notepad Open File window i.e. ‘test.txt‘;

We can conclude this demo with the following observations:

Notepad is indeed using CreateFileW when it opens the files
The file is being open with the flag OPEN_EXISTING i.e. it will attempt to open existing file, without overwriting it
The file is open in both FILE_SHARE_READ and FILE_SHARE_WRITE mode i.e. you could open file in Notepad and then still overwrite it with an external application e.g. echo foo>test.txt while it is being edited.

We also learnt that:

Loading applications for analysis and passing arguments to it is very straightforward
In order to use it efficiently, it is good to have some basic understanding of Windows programming, You need to know which APIs to select to monitor the analyzed program efficiently.
HAM works on Windows 8 Developer Preview 🙂

As you can see, by just looking at arguments passed to APIs, as well as the flow of the APIs being called, multiple things can be done:

it may help in in-house malware analysis
it may help with vulnerability research
it may help in understanding Windows API and Windows internals
it may allow to discover undocumented or unexpected quirks of windows (e.g. what mutexes are created by a given application, what strings are hard coded and compared against by certain APIs, etc.)

Enjoy!