Challenge 21: Dynamic API Resolution

Medium API Hook Evasion Target: Rule 7

Objective

Execute a program that calls NtAllocateVirtualMemory without Rule 7 detecting the import.

Scanner Behavior

Rule 7 reads the PE Import Address Table (IAT) of new processes and cross-references imported function names against the loaded EDR hook profile:

proc ruleHookedApiImports(info: ProcessInfo, profile: HookProfile): seq[Detection] =
  let imports = readPeImports(info.imagePath)
  for imp in imports:
    if normalized in profile.hookedApis:
      matchedApis.add(imp)

The scanner only sees static imports — functions listed in the PE header’s import directory at compile time.

Rules

The EDR must be running with --profile crowdstrike (or any profile that hooks NtAllocateVirtualMemory)
Your program must successfully call NtAllocateVirtualMemory
Rule 7 must NOT trigger a HOOKED_API_IMPORT detection for that API

Hints

Hint 1

The scanner reads the PE file on disk, not the process memory at runtime.

Hint 2

What if the function isn't in the import table but is resolved at runtime?

Hint 3

`GetProcAddress(GetModuleHandle("ntdll.dll"), "NtAllocateVirtualMemory")` resolves the function without a static import.