How to use HAM?

This is a short intro tutorial on how to use HAM. The basic idea is to show how to:

  • Load an application for analysis
  • Pass command line arguments to the analyzed program
  • Choose APIs
  • Run
  • Observe the output

So, let’s begin:

  • First, download and run HAM. You should see the following screen:
  • Now, Press F3, Ctrl-O, or choose File->Open Executable from the application menu.
  • Go to your System Directory:
  • Type ‘notepad.exe‘ and hit Enter
  • Type the command line argument for Notepad e.g. ‘test.txt‘ – this file will be opened by Notepad:
  • Press Alt+A or click the icon as shown below: 
  • Choose ‘CreateFileW‘ API in the API Functions window:
  • Press F5 or click the icon as shown below:
  • The Notepad will now be launched, modules loaded by Notepad will be shown in a small window; for each module loaded, HAM will attempt to intercept all APIs as selected earlier in the API Functions – in our case it is only ‘CreateFileW’ :
  • Each module loaded by Notepad is shown in the output pane; Notepad window is shown on the Desktop as well; as you can see, CreateFileW API has been called once, and with the argument being a file name that we typed in Notepad Open File window i.e. ‘test.txt‘; 

We can conclude this demo with the following observations:

  • Notepad is indeed using CreateFileW when it opens the files
  • The file is being open with the flag OPEN_EXISTING i.e. it will attempt to open existing file, without overwriting it
  • The file is open in both FILE_SHARE_READ and FILE_SHARE_WRITE mode i.e. you could open file in Notepad and then still overwrite it with an external application e.g. echo foo>test.txt while it is being edited.

We also learnt that:

  • Loading applications for analysis and passing arguments to it is very straightforward
  • In order to use it efficiently, it is good to have some basic understanding of Windows programming, You need to know which APIs to select to monitor the analyzed program efficiently.
  • HAM works on Windows 8 Developer Preview 🙂

As you can see, by just looking at arguments passed to APIs, as well as the flow of the APIs being called, multiple things can be done:

  • it may help in in-house malware analysis
  • it may help with vulnerability research
  • it may help in understanding Windows API and Windows internals
  • it may allow to discover undocumented or unexpected quirks of windows (e.g. what mutexes are created by a given application, what strings are hard coded and compared against by certain APIs, etc.)
Enjoy!
Posted in HAM

Hexacorn Application Monitor

Between years 2004-2007 I maintained a small hobby programming page where I was releasing free software tools and various snippets in assembly. One of the programs I have written at that time was Kakeeware Application Monitor – a very small API monitor coded entirely in x86 assembly language. The last update has been made in 2007 and I have not touched the program since.

In July 2011 I decided to come back to my old sources and fix a few bugs and add new APIs that have been introduced in Vista and Windows 7, plus other APIs I could find. After poking around I managed to build a decent list of new APIs and these that I have missed previously. Turns out that after putting it all together, the number of APIs that the program can now handle expanded to almost 12000!

After few months of polishing, I am finally ready to release a new version. Since all my code will be now released under Hexacorn name, I changed the program’s name as well, so from now on it will be called Hexacorn Application Monitor (a.k.a. HAM). And just for the fun of it, I also added ‘Pro’ to its name :).

Hexacorn Application Monitor

Hexacorn Application Monitor

This program is FREE for both commercial and non-commercial use. Yup, you heard that right. Note that this is a new version of the tool that has been not updated in 4 years. It surely contains bugs and some of the APIs may not be intercepted properly. If you find bugs. or find it useful, please do let me know. Thanks.

Enjoy!

I will soon post some practical examples on how to use it and what sort of stuff you can find with it.

Download HAM