kernel32.dll API hash lookup table

This page contains a lookup table of hashed kernel32.dll APIs (MD5: D385B6882BFE47BEDF2A2B9547C91A16, SHA-1: 907eec7568423245054be9c59638f0e2bc04afad, SHA-256: a4e40c348031047b966c18f2761ee0460a226905721d2f29327528cb2b213cb1). The hash algorithm used to produce the hashes is the one ‘The Last Stage of Delirium Research Group’ wrote [[1]]. The DLL version from which the APIs were hashed is 10.0.17763.1 (WinBuild.160101.0800).

Hashing APIs is a technique in shellcode writing to obfuscate the name of APIs. Hashing assists in detection evasion purposes.

The page is in essence an effort to document the exported APIs of important Windows libraries. Additional work has been documented in:

• iphlpapi.dll API hash lookup table
• ntoskrnl.exe API hash lookup table
• ntdll.dll API hash lookup table

The C version of the hash algorithm

DWORD HashAPI(CHAR* api)
{
	unsigned int h = 0;
	while (*api)
	{
		h = ((h << 5) | (h >> 27)) + *api++;
	}

	//printf("hashed API: 0x%x\n", h);
	return h;
}

The hash algorithm in Assembly

HashAPIName proc
	xor rax, rax
	lea rsi, [rcx]
	lodsb
	xor rbx, rbx	; hashed API	
	test al, al
	jz no_op
hash_loop:
	mov edx, ebx
	shl ebx, 5
	shr edx, 27
	or ebx, edx
	add ebx, eax
	lodsb
	test al, al
	jnz hash_loop
	mov eax, ebx
no_op:
	ret
HashAPIName endp

Look up table