百科.dev
全部条目AI 编程趋势榜开源项目技术资讯提交条目
登录
< 返回工具列表
H

HookLib

> 编程语言
开源

该函数拦截库使用纯 C 语言和 NativeAPI,支持用户模式和内核模式

760 stars0 点赞0 次浏览
访问官网GitHub

工具介绍

该函数拦截库使用纯 C 语言和 NativeAPI,支持用户模式和内核模式

HookLib²

The Win32 lightweight functions interception library

✔ Advantages:

  • Written on pure C
  • Extremely lightweight
  • Based on the fastest and lightweight Zydis disassembler
  • Uses only NativeAPI functions
  • Has no other dependencies
  • Kernelmode support
  • Supports instructions relocation and thread's contexts fixup

What's new in the 2nd Gen:

  • The HookLib was completely rewritten
  • Extremely reduced allocations, processes/threads enumerations and handles manipulations count
  • Multihook/multiunhook support that hooks/unhooks multiple functions in one session
  • Extremely reduced memory consumption for usermode hooks: one hook page (4Kb) can hold 39 cells for nearest hooks that removes the need to allocate one page per each hook
  • Support for KM->UM hooks (even with support for contexts fixup directly from kernelmode):
    • KM:Amd64 -> UM:Amd64
    • KM:Amd64 -> UM:Wow64
    • KM:i386 -> UM:i386

How it works:

TargetFunction():                                 ^ ; return
-> jmp Interceptor ------> Interceptor():         |
   ??? ; Broken bytes        ... Handler code ... |
   ... ; Continuation  OriginalBeginning():
   ...         +---------|-> ...                  |      ... Original beginning ...
   ret --------+         |   ret -----------------+      ... of TargetFunction ...
                         +------------------------------ jmp Continuation

Trampolines:

Supported trampolines:

assembly
Jump to a relative offset:
E9 44 33 22 11  |  jmp rip+0x11223344 ; Relative jump to ±2Gb only

Jump to an absolute address (x32):
FF 25 44 33 22 11  | jmp ds:[0x11223344]
NN NN NN NN        |  Reference** and select the HookLib.  
Then add **./HookLib/HookLib/** folder to your header folders list and you're good to go.
```cpp
#include 

int func(int a, int b)
{
    return a + b;
}

int handler(int a, int b)
{
    return a * b;
}

template 
Fn hookFunc(Fn fn, Fn handler)
{
    return static_cast(hook(fn, handler));
}

void testSimpleHook()
{
    const auto orig = hookFunc(func, handler);
    
    assert(func(2, 3) == 6); // Hooked, the 'handler' will be called instead
    assert(orig(2, 3) == 5);
    
    unhook(orig);

    assert(func(2, 3) == 5);
}

void testCppHelpers()
{
    const auto holder = HookFactory::install(func, handler);
    assert(func(2, 3) == 6);
    assert(holder.call(2, 3) == 5);
}

int main()
{
    testSimpleHook();
    testCppHelpers();

    return 0;
}

Issues· 0 开放

查看全部 Issues在 GitHub 打开

暂无开放 Issues,或尚未同步最近议题。

> 标签

Chookhook-apihookinghooklib

暂无评论,来聊聊你的看法吧

> 工具信息

发布日期2026年8月1日
最后更新2026年9月17日
分类编程语言
定价开源

> 相关工具

T
TypeScript
JavaScript 的超集,为前端与全栈提供静态类型
P
Python
通用编程语言,广泛用于 Web、数据与 AI
G
Go
Google 推出的简洁高效系统语言