{"id":58,"date":"2011-11-13T14:41:24","date_gmt":"2011-11-13T14:41:24","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=58"},"modified":"2015-04-08T05:20:34","modified_gmt":"2015-04-08T05:20:34","slug":"how-to-use-ham","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2011\/11\/13\/how-to-use-ham\/","title":{"rendered":"How to use HAM?"},"content":{"rendered":"<p>This is a short intro tutorial on how to use HAM. The basic idea is to show how to:<\/p>\n<ul>\n<li>Load an application for analysis<\/li>\n<li>Pass command line arguments to the analyzed\u00a0program<\/li>\n<li>Choose APIs<\/li>\n<li>Run<\/li>\n<li>Observe the output<\/li>\n<\/ul>\n<p>So, let&#8217;s begin:<\/p>\n<ul>\n<li>First, download and run <a title=\"Hexacorn Application Monitor\" href=\"https:\/\/hexacorn.com\/download.php?f=ham.exe\">HAM<\/a>. You should see the following screen:<a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2011\/11\/ham_tut1_1.png\"><img decoding=\"async\" loading=\"lazy\" class=\"size-medium wp-image-59 aligncenter\" title=\"How to use HAM - 1\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2011\/11\/ham_tut1_1-300x201.png\" alt=\"\" width=\"300\" height=\"201\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2011\/11\/ham_tut1_1-300x201.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2011\/11\/ham_tut1_1.png 852w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a><\/li>\n<li>Now, Press <strong>F3<\/strong>, <strong>Ctrl-O<\/strong>, or choose <strong>File-&gt;Open Executable<\/strong> from the application menu.<a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2011\/11\/ham_tut1_2.png\"><img decoding=\"async\" loading=\"lazy\" class=\"size-medium wp-image-61 aligncenter\" title=\"How to use HAM - 2\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2011\/11\/ham_tut1_2-300x210.png\" alt=\"\" width=\"300\" height=\"210\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2011\/11\/ham_tut1_2-300x210.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2011\/11\/ham_tut1_2.png 683w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a><\/li>\n<li>Go to your System Directory:<\/li>\n<li>Type &#8216;<strong>notepad.exe<\/strong>&#8216; and hit Enter<\/li>\n<li>Type the command line argument\u00a0for Notepad e.g.\u00a0&#8216;<strong>test.txt<\/strong>&#8216; &#8211; this file will be opened by Notepad:<a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2011\/11\/ham_tut1_3.png\"><img decoding=\"async\" loading=\"lazy\" class=\"size-medium wp-image-61 aligncenter\" title=\"How to use HAM - 3\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2011\/11\/ham_tut1_3-300x201.png\" alt=\"\" width=\"300\" height=\"201\" \/><\/a><\/li>\n<li>Press <strong>Alt+A<\/strong> or click the icon as shown below:\u00a0<a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2011\/11\/ham_tut1_4.png\"><img decoding=\"async\" loading=\"lazy\" class=\"size-medium wp-image-61 aligncenter\" title=\"How to use HAM - 4\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2011\/11\/ham_tut1_4-300x201.png\" alt=\"\" width=\"300\" height=\"201\" \/><\/a><\/li>\n<li>Choose &#8216;<strong>CreateFileW<\/strong>&#8216; API in the <strong>API Functions<\/strong> window:<a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2011\/11\/ham_tut1_5.png\"><img decoding=\"async\" loading=\"lazy\" class=\"size-medium wp-image-61 aligncenter\" title=\"How to use HAM - 5\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2011\/11\/ham_tut1_5-300x201.png\" alt=\"\" width=\"300\" height=\"201\" \/><\/a><\/li>\n<li>Press <strong>F5<\/strong> or click the icon as shown below:<a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2011\/11\/ham_tut1_6.png\"><img decoding=\"async\" loading=\"lazy\" class=\"size-medium wp-image-61 aligncenter\" title=\"How to use HAM - 6\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2011\/11\/ham_tut1_6-300x201.png\" alt=\"\" width=\"300\" height=\"201\" \/><\/a><\/li>\n<li>The Notepad\u00a0will now be launched, modules loaded by Notepad will be shown in a small window; for each module loaded, HAM will attempt to intercept all APIs as selected earlier in the <strong>API Functions<\/strong> &#8211; in our case it is only<strong> &#8216;CreateFileW&#8217;<\/strong>\u00a0:<a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2011\/11\/ham_tut1_7.png\"><img decoding=\"async\" loading=\"lazy\" class=\"size-medium wp-image-61 aligncenter\" title=\"How to use HAM - 7\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2011\/11\/ham_tut1_7-300x201.png\" alt=\"\" width=\"300\" height=\"201\" \/><\/a><\/li>\n<li>Each module loaded by\u00a0Notepad is shown in the output pane; Notepad window is shown on the Desktop as well;\u00a0as\u00a0you can see, CreateFileW API has been called once, and with the argument being a file name that we typed in Notepad Open File window i.e. &#8216;<strong>test.txt<\/strong>&#8216;;\u00a0<a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2011\/11\/ham_tut1_8.png\"><img decoding=\"async\" loading=\"lazy\" class=\"size-medium wp-image-61 aligncenter\" title=\"How to use HAM - 8\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2011\/11\/ham_tut1_8-300x187.png\" alt=\"\" width=\"300\" height=\"187\" \/><\/a><\/li>\n<\/ul>\n<p style=\"text-align: left;\">We can conclude this demo with the following observations:<\/p>\n<ul>\n<li>Notepad is indeed using <strong>CreateFileW<\/strong> when it opens the files<\/li>\n<li>The file is being open with the flag <strong>OPEN_EXISTING<\/strong> i.e. it will attempt to open existing file, without overwriting it<\/li>\n<li>The file is open in both <strong>FILE_SHARE_READ<\/strong> and <strong>FILE_SHARE_WRITE<\/strong> mode i.e. you could open file in Notepad and then still overwrite it with an external application e.g. <strong>echo foo&gt;test.txt<\/strong> while it is being edited.<\/li>\n<\/ul>\n<p>We also learnt that:<\/p>\n<ul>\n<li>Loading applications for analysis and passing arguments to it is very straightforward<\/li>\n<li>In order to use it efficiently, it is good to have some basic understanding of Windows programming, You need to know which APIs to select to monitor the analyzed program efficiently.<\/li>\n<li>HAM works on Windows 8 Developer Preview \ud83d\ude42<\/li>\n<\/ul>\n<p>As you can see, by just looking at arguments passed to APIs, as well as the flow of the APIs being called, multiple things can be done:<\/p>\n<ul>\n<li>it may help in in-house malware analysis<\/li>\n<li>it may help with vulnerability research<\/li>\n<li>it may help in understanding Windows API and Windows internals<\/li>\n<li>it may allow to discover undocumented or unexpected quirks\u00a0of windows (e.g. what mutexes are created by a given application, what strings are hard coded and compared against by certain APIs, etc.)<\/li>\n<\/ul>\n<div style=\"text-align: left;\">Enjoy!<\/div>\n","protected":false},"excerpt":{"rendered":"<p>This is a short intro tutorial on how to use HAM. The basic idea is to show how to: Load an application for analysis Pass command line arguments to the analyzed\u00a0program Choose APIs Run Observe the output So, let&#8217;s begin: &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2011\/11\/13\/how-to-use-ham\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[6],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/58"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=58"}],"version-history":[{"count":8,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/58\/revisions"}],"predecessor-version":[{"id":72,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/58\/revisions\/72"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=58"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=58"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=58"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}