Api_Hashing

ApiHashing Overview The CustomApiHashing project demonstrates a powerful method for dynamically resolving API functions using custom hashing techniques. By bypassing traditional GetProcAddress and GetModuleHandle APIs, this approach avoids detection by hooks set by antivirus or EDR tools. This implementation leverages Windows internal structures like the Process Environment Block (PEB) and Export Address Table (EAT) to enumerate and resolve APIs purely via their hash values. Table of Contents Overview Purpose How It Works Requirements Installation Usage Code Explanation Disclaimer License Purpose Dynamically resolve Windows API functions using custom hashing. Evade detection by avoiding standard Windows API resolution mechanisms. Provide a learning resource for reverse engineers and malware analysts. How It Works Hashing Mechanism: The API and DLL names are hashed using a custom algorithm. Custom Module Retrieval: Modules are located manually via the PEB (Process Environment Block). Function Resolution: The Export Address Table (EAT) is traversed to locate functions using their hash values. Dynamic Invocation: The resolved function is called dynamically.