HookDump - a dll exports entry-point dumper
Coded by mIG-21^CookieCrK

1. What is HookDump?

	HookDump is a utility, which allows you to dump first bytes of any function exported by a dll. It supports both mnemonic, and opcode output. I decided to make this script, when I read a manual for CoXoC's API Hooker (really good program btw.). CoX was suggesting, that we send him infos on API's, so that he can update the configuration file for his app. Well, it came to my mind, that it's a question of few hours to make a utility to extract this info automatically. Coding it from scratch would require many days (and making a disassembler wasn't my intention), but fortunately we have a really good disasm (and no, it's not W32Dasm). I'm talking about IDA. One of the most powerful features of this tool, is the ability to run scripts written in IDA C language. The IDC API is not the best documented one, but after 2 hours of coding I had a running version of the script.

2. Requirements:
   - Interactive Disassembler (IDA)
     I'm not sure, which version of the program you need. I have 4.0,       but it may work with an older version as well.

3. Usage.
	Since HookDump is an IDA script, you have to run the disassembler first. Select a file to disasm (it must export some symbols, like a dll for example). Now select File->LoadFile->IDCFile from the menu, or just hit F2. Select hookdump.idc file, and wait. In the message log at the bottom of IDA window you will see output from HookDump script. It will report you the number of exports found, and what it's currently doing. When it finishes, you will have a dump file (probably in IDA directory).

4. Dump file format.
	Dump files are currently formatted improperly, so the output may be hard to interpret. At the beggining of the file are few lines of infos (skip them). Then, for each export you have a entry of following format:

decorated_function_name
<demangled_function_name> 	(optional, only in C++, not tested)
	address		opcodes		mnemonic
	address		opcodes		mnemonic
	(and so on...)

The number of disassembled instructions is hardcoded in the script. To change it, look for INSTRUCTIONS_TO_DISASM definition in hookdump.idc file.

With HookDump's output you can easily add new entries to the API Hooker config file, but it's not the subject of this manual. For further info, reference to API Hooker's documentation.

Hope you find the script useful :-)
mIG-21^CookieCrK
