HooksBox

https://github.com/x3ucher/hooxbox
Admin
HooksBox is an advanced anti-detection sandbox toolkit for Windows designed to conceal...
Tokens:10,130
Snippets:45
Trust Score:4.1
Update:2 weeks ago
Show doc for...
Tokens:
Raw
### Run launcher.exe with --debug-inject and extra flags

Source: https://github.com/x3ucher/hooxbox/blob/master/README.md

Example of turning on the default-off CPUID masking and cranking logging up with --debug-inject. The extra arguments are forwarded to DebuggerWrapper.exe.

```powershell
.\launcher.exe --debug-inject pafish.exe --cpuid --level DEBUG --log run.log
```

--------------------------------

### Direct vmcheck.exe output

Source: https://github.com/x3ucher/hooxbox/blob/master/DebuggerWrapper/README.md

Example output from running vmcheck.exe directly, showing all checks reporting CLEAN.

```text
> vmcheck.exe
[CHECK] rdtsc_diff             : CLEAN
[CHECK] rdtsc_diff_vmexit      : CLEAN
[CHECK] cpuid_hv_bit           : CLEAN
[CHECK] cpuid_vendor_leaf      : CLEAN    -- (zeros)
```

--------------------------------

### DebuggerWrapper debug session output

Source: https://github.com/x3ucher/hooxbox/blob/master/DebuggerWrapper/README.md

Example output from running DebuggerWrapper with --level DEBUG, showing CPUID and RDTSC interception logs and a run summary. Note that on a bare-metal AMD host masking is a no-op; inside VirtualBox the same code wipes vendor-agnostically.

```text
> DebuggerWrapper.exe --target vmcheck.exe --level DEBUG
...
[cpuid] hit @ 0x7ff...1907, eax(leaf)=0x00000001 ... | host ecx=0x7ED8320B (HV bit clear) | masked ecx=0x7ED8320B
[cpuid] hit @ 0x7ff...1a03, eax(leaf)=0x40000000 ... | host eax=0x00000000 ... | masked eax=0x00000000 ...
[rdtsc] hit @ ..., virtTsc 18072... -> 18072... (delta=166)
...
[core]  Run summary: CPUID intercepts=11, RDTSC intercepts=20, foreign BPs=0, BPs total=12, exit=0
```

--------------------------------

### Run vb-masquerade.ps1 to mask a VirtualBox VM

Source: https://github.com/x3ucher/hooxbox/blob/master/README.md

Run from a PowerShell prompt on the host machine where VirtualBox is installed. The VM must be powered off; the script verifies this. The script touches only the named VM, never global VirtualBox settings, and always snapshots the prior values before modifying them. Reboot the VM once after running to make changes take effect.

```powershell
# Interactive — script lists registered VMs and asks which to mask
.\vb-masquerade.ps1

# Explicit VM, default Dell profile
.\vb-masquerade.ps1 -VM "Win10-Analysis"

# Different host identity
.\vb-masquerade.ps1 -VM "Win10-Analysis" -MaskProfile Lenovo

# Preview the changes without applying them
.\vb-masquerade.ps1 -VM "Win10-Analysis" -DryRun

# Roll back to whatever the extradata was before the last apply
.\vb-masquerade.ps1 -VM "Win10-Analysis" -Restore
```

--------------------------------

### Recommended workflow: vb-masquerade.ps1 and launcher.exe

Source: https://github.com/x3ucher/hooxbox/blob/master/README.md

Recommended two-step workflow for using hooxbox. Step 1 runs vb-masquerade.ps1 on the host before booting the VM to remove VBox-specific SMBIOS/ACPI/disk/MAC/TSC/CPUID signatures; reboot the VM to take effect. Step 2 runs launcher.exe inside the VM to launch the target with hooksbox.dll and optionally DebuggerWrapper.exe.

```text
┌─────────────────────────────────────────────────────────────────────┐
│ STEP 1 — on the HOST, BEFORE booting the VM                         │
│ ─────────────────────────────────────────────                       │
│   .\vb-masquerade.ps1 -VM "MyAnalysisVM" -MaskProfile Dell          │
│                                                                     │
│ Removes VBox-specific SMBIOS / ACPI / disk / MAC / TSC / CPUID      │
│ signatures at the hypervisor level. Reboot the VM to take effect.   │
└─────────────────────────────────────────────────────────────────────┘
                                ▼
┌─────────────────────────────────────────────────────────────────────┐
│ STEP 2 — INSIDE the VM, when running a detector / sample            │
│ ────────────────────────────────────────────────────                │
│   .\launcher.exe                                                    │
│   <interactive prompts for inject + debug>                          │
│                                                                     │
│ Runs target with hooksbox.dll (API/Nt-level masking) and optionally │
│ DebuggerWrapper.exe (CPU-instruction masking).                      │
└─────────────────────────────────────────────────────────────────────┘
```

--------------------------------

### Clone and enter the hooxbox repository

Source: https://github.com/x3ucher/hooxbox/blob/master/README.md

Clone the repository and navigate into the project directory before building.

```powershell
git clone https://github.com/x3ucher/hooxbox.git
cd hooxbox
```

--------------------------------

### Build HooksBox.sln with MSBuild

Source: https://github.com/x3ucher/hooxbox/blob/master/README.md

Build the solution from a Developer Command Prompt. Use HooksBox.sln, not the individual .vcxproj, because HooksBox.vcxproj references $(SolutionDir)tools\MinHook\include, which resolves to an empty directory when built in isolation.

```powershell
msbuild HooksBox.sln /p:Configuration=Debug /p:Platform=x64
```

--------------------------------

### Run launcher.exe in interactive mode

Source: https://github.com/x3ucher/hooxbox/blob/master/README.md

Interactive launcher mode. The launcher reports the chosen mode and then runs the target. Three modes are possible depending on the answers: raw, inject, debug, and debug+inject.

```text
.\launcher.exe
=== HooksBox Launcher ===

Target executable path (full or relative): pafish.exe
Inject hooksbox.dll (API-hook layer)?               [Y/n]: y
Mask CPUID/RDTSC via DebuggerWrapper (instruction layer)? [y/N]: y
```

--------------------------------

### DebuggerWrapper command-line usage

Source: https://github.com/x3ucher/hooxbox/blob/master/DebuggerWrapper/README.md

Shows the full command-line syntax and all options for DebuggerWrapper.exe, including required --target and optional flags for logging, verbosity, and interception controls.

```text
DebuggerWrapper.exe --target <path-to-target.exe> [options]

  --target <path>            Required. Path to the target executable.
  --args   <string>          Command line passed to the target.
  --log    <path>            Log file path (default: debugger_wrapper.log).
  --level  ERROR|INFO|DEBUG  Verbosity (default: INFO).
  --no-stdout                Suppress stdout mirror.
  --no-cpuid                 Disable CPUID interception.
  --no-rdtsc                 Disable RDTSC interception.
  --scan-dlls                Also scan loaded DLLs (off by default).
  --jitter-min <N>           Min ticks added per virtual RDTSC (default: 80).
  --jitter-max <N>           Max ticks added per virtual RDTSC (default: 200).
  --help
```

--------------------------------

### Build DebuggerWrapper with MSBuild

Source: https://github.com/x3ucher/hooxbox/blob/master/DebuggerWrapper/README.md

Builds the DebuggerWrapper project for x64 in Debug configuration using MSBuild from a Developer Command Prompt.

```text
msbuild HooksBox.sln /p:Configuration=Debug /p:Platform=x64 /t:DebuggerWrapper
```

--------------------------------

### Invoke DebuggerWrapper via Launcher

Source: https://github.com/x3ucher/hooxbox/blob/master/DebuggerWrapper/README.md

Shows how to launch DebuggerWrapper using the existing Launcher.exe, which resolves DebuggerWrapper.exe next to itself and forwards arguments after the target path.

```text
Launcher.exe --debug C:\path\vmcheck.exe
```

--------------------------------

### Run launcher.exe in non-interactive CLI mode

Source: https://github.com/x3ucher/hooxbox/blob/master/README.md

Non-interactive CLI usage of launcher.exe. Everything after the target path in --debug / --debug-inject is forwarded verbatim to DebuggerWrapper.exe.

```powershell
.\launcher.exe <target.exe>                    # interactive prompts for inject/debug
.\launcher.exe --inject <target.exe>           # mode: inject
.\launcher.exe --debug  <target.exe> [extra]   # mode: debug
.\launcher.exe --debug-inject <target.exe> [extra]   # mode: debug + inject
```

--------------------------------

### Invoke DebuggerWrapper.exe with --target

Source: https://github.com/x3ucher/hooxbox/blob/master/README.md

Command-line invocation for DebuggerWrapper.exe. The --target flag is required; all other options are optional. See the table for defaults and meanings of each flag.

```text
DebuggerWrapper.exe --target <path.exe> [options]
```

--------------------------------

### DEBUG log tail with CPUID and RDTSC intercepts

Source: https://github.com/x3ucher/hooxbox/blob/master/README.md

End-to-end DEBUG log tail showing CPUID and RDTSC intercepts and the run summary. This output is produced when CPUID interception is enabled inside a VM.

```text
[cpuid] hit @ 0x7ff...1907, leaf=0x00000001 sub=0x0 | host ecx=0x80000201 | masked ecx=0x00000201
[cpuid] hit @ 0x7ff...1a03, leaf=0x40000000 sub=0x0 | host eax=… ebx=VBoxVBox… | masked eax=0 ebx=0 ecx=0 edx=0
[rdtsc] hit @ 0x7ff...1c9f, virtTsc N -> N+160
[core]  Run summary: CPUID intercepts=11, RDTSC intercepts=20, foreign BPs=0, BPs total=12, exit=0
```
Tokens:
Raw