Hooking

<h2 id="methods">Methods</h2>
<p>Typically hooks are inserted while software is already running, but hooking is a tactic that can also be employed prior to the application being started. Both these techniques are described in greater detail below.
</p>
<h3>Source modification</h3>
<p>Hooking can be achieved by modifying the source of the <a href="/facts/Executable/VSst9eLA">executable</a> or <a href="/facts/Library_(computing)/xRzL3P7q">library</a> before an application is running, through techniques of <a href="/facts/Reverse_engineering/pmJCV7J7">reverse engineering</a>. This is typically used to intercept function calls to either monitor or replace them entirely.
</p><p>For example, by using a <a href="/facts/Disassembler/4PR39BbK">disassembler</a>, the <a href="/facts/Entry_point/nN52vHKb">entry point</a> of a <a href="/facts/Function_(computer_science)/9vFJrg0A">function</a> within a <a href="/facts/Modular_programming/sNoqKvRD">module</a> can be found. It can then be altered to instead dynamically load some other library module and then have it execute desired methods within that loaded library. If applicable, another related approach by which hooking can be achieved is by altering the <a href="/facts/Portable_Executable/pJy7AkuY">import table</a> of an executable. This table can be modified to load any additional library modules as well as changing what external code is invoked when a function is called by the application.
</p><p>An alternative method for achieving function hooking is by intercepting function calls through a <a href="/facts/Wrapper_library/b61otW6r">wrapper library</a>. A wrapper is a version of a library that an application loads, with all the same functionality of the original library that it will replace. That is, all the functions that are accessible are essentially the same between the original and the replacement. This wrapper library can be designed to call any of the functionality from the original library, or replace it with an entirely new set of logic.
</p>
<h3>Runtime modification</h3>
<p>Operating systems and software may provide the means to easily insert event hooks at <a href="/facts/Run_time_(program_lifecycle_phase)/lCxKsrzB">runtime</a>. It is available provided that the <a href="/facts/Process_(computing)/Vcq7EnUV">process</a> inserting the hook is granted enough permission to do so. Microsoft Windows for example, allows users to insert hooks that can be used to process or modify system <a href="/facts/Event_(computing)/0YdM6AoB">events</a> and application events for <a href="/facts/Dialog_box/VgWHgrE2">dialogs</a>, <a href="/facts/Scrollbar/4PXB6nCS">scrollbars</a>, and <a href="/facts/Menu_(computing)/zdKCgPGq">menus</a> as well as other items.  It also allows a hook to insert, remove, process or modify <a href="/facts/Keyboard_(computing)/MczF9LIS">keyboard</a> and <a href="/facts/Mouse_(computing)/fJpa1tUE">mouse</a> events.  Linux provides another example where hooks can be used in a similar manner to process network events within the <a href="/facts/Kernel_(operating_system)/uEj4U3Rz">kernel</a> through <a href="/facts/NetFilter/M3rtyl3r">NetFilter</a>.
</p><p>When such functionality is not provided, a special form of hooking employs intercepting the library function calls made by a process. Function hooking is implemented by changing the very first few code instructions of the target function to jump to an injected code. Alternatively on systems using the <a href="/facts/Shared_library/xRzL3P7q">shared library</a> concept, the <a href="/facts/Interrupt_vector/wq6sxJTo">interrupt vector</a> table or the <a href="/facts/Executable/VSst9eLA">import descriptor table</a> can be modified in memory. Essentially these tactics employ the same ideas as those of source modification, but instead altering instructions and structures located in the memory of a process once it is already running.
</p>
<h2 id="sample-code">Sample code</h2>
<h3>Virtual method table hooking</h3>
<p>Whenever a class defines/inherits a <a href="/facts/Virtual_function/cnxckyHy">virtual function</a> (or method), compilers add a hidden member variable to the class which points to a <a href="/facts/Virtual_method_table/rFISodUl">virtual method table</a> (VMT or Vtable). Most compilers place the hidden VMT pointer at the first 4 bytes of every instance of the class. A VMT is basically an array of <a href="/facts/Reference_(computer_science)/1vm2Bph1">pointers</a> to all the virtual functions that instances of the class may call. At runtime these pointers are set to point to the right functions, because at <a href="/facts/Compile_time/yCdI3oqn">compile time</a>, it is not yet known if the base function is to be called or if an overridden version of the function from a derived class is to be called (thereby allowing for <a href="/facts/Polymorphism_(computer_science)/S3cCKsVT">polymorphism</a>). Therefore, virtual functions can be hooked by replacing the pointers to them within any VMT that they appear. The code below shows an example of a typical VMT hook in Microsoft Windows, written in C++.<a class="footnote-ref" id="fnref:1" href="#fn:1"><sup>1</sup></a>
</p>
#include <iostream>
#include "windows.h"
 
using namespace std;
 
class VirtualClass
{
public:
 
    int number;
 
    virtual void VirtualFn1() //This is the virtual function that will be hooked.
    {
        cout << "VirtualFn1 called " << number++ << "\n\n";
    }
};
 
 
 
 
using VirtualFn1_t = void(__thiscall*)(void* thisptr); 
VirtualFn1_t orig_VirtualFn1;

void __fastcall hkVirtualFn1(void* thisptr, int edx) //This is our hook function which we will cause the program to call instead of the original VirtualFn1 function after hooking is done.
{
    cout << "Hook function called" << "\n";
 
    orig_VirtualFn1(thisptr); //Call the original function.
}
 
 
 
 
int main()
{
    VirtualClass* myClass = new VirtualClass(); //Create a pointer to a dynamically allocated instance of VirtualClass.
 
    void** vTablePtr = *reinterpret_cast<void***>(myClass); //Find the address that points to the base of VirtualClass' VMT (which then points to VirtualFn1) and store it in vTablePtr.
 
    DWORD oldProtection;
    VirtualProtect(vTablePtr, 4, PAGE_EXECUTE_READWRITE, &oldProtection); //Removes page protection at the start of the VMT so we can overwrite its first pointer.
 
    orig_VirtualFn1 = reinterpret_cast<VirtualFn1_t>(*vTablePtr); //Stores the pointer to VirtualFn1 from the VMT in a global variable so that it can be accessed again later after its entry in the VMT has been 
                                                                  //overwritten with our hook function.
 
    *vTablePtr = &hkVirtualFn1; //Overwrite the pointer to VirtualFn1 within the virtual table to a pointer to our hook function (hkVirtualFn1).
 
    VirtualProtect(vTablePtr, 4, oldProtection, 0); //Restore old page protection.
 
    myClass->VirtualFn1(); //Call the virtual function from our class instance. Because it is now hooked, this will actually call our hook function (hkVirtualFn1).
    myClass->VirtualFn1();
    myClass->VirtualFn1();
 
    delete myClass;
 
    return 0;
}

<p>All virtual functions must be class member functions, and all (non-static) class member functions are called with the __thiscall <a href="/facts/Calling_convention/FtzN2BKj">calling convention</a> (unless the member function takes a variable number of arguments, in which case it is called with __cdecl). The __thiscall calling convention passes a pointer to the calling class instance (commonly referred to as a "this" pointer) via the ECX register (on the x86 architecture). Therefore, in order for a hook function to properly intercept the "this" pointer that is passed and take it as an argument, it must look into the ECX register. In the above example, this is done by setting the hook function (hkVirtualFn1) to use the __fastcall calling convention, which causes the hook function to look into the ECX register for one of its arguments.
</p><p>Also note that, in the above example, the hook function (hkVirtualFn1) is not a member function itself so it cannot use the __thiscall calling convention. __fastcall has to be used instead because it is the only other calling convention that looks into the ECX register for an argument.
</p>
<h3>C# keyboard event hook</h3>
<p>The following example will hook into   keyboard events in Microsoft Windows using the <a href="/facts/.NET_Framework/J6QDAUhP">Microsoft .NET Framework</a>.
</p>
using System.Runtime.InteropServices;

namespace Hooks;

public class KeyHook
{
    /* Member variables */
    protected static int Hook;
    protected static LowLevelKeyboardDelegate Delegate;
    protected static readonly object Lock = new object();
    protected static bool IsRegistered = false;

/* DLL imports */
    [DllImport("user32")]
    private static extern int SetWindowsHookEx(int idHook, LowLevelKeyboardDelegate lpfn,
        int hmod, int dwThreadId);

[DllImport("user32")]
    private static extern int CallNextHookEx(int hHook, int nCode, int wParam, KBDLLHOOKSTRUCT lParam);

[DllImport("user32")]
    private static extern int UnhookWindowsHookEx(int hHook);

/* Types & constants */
    protected delegate int LowLevelKeyboardDelegate(int nCode, int wParam, ref KBDLLHOOKSTRUCT lParam);
    private const int HC_ACTION = 0;
    private const int WM_KEYDOWN = 0x0100;
    private const int WM_KEYUP = 0x0101;
    private const int WH_KEYBOARD_LL = 13;

[StructLayout(LayoutKind.Sequential)]
    public struct KBDLLHOOKSTRUCT
    {
        public int vkCode;
        public int scanCode;
        public int flags;
        public int time;
        public int dwExtraInfo;
    }

/* Methods */
    static private int LowLevelKeyboardHandler(int nCode, int wParam, ref KBDLLHOOKSTRUCT lParam)
    {
        if (nCode == HC_ACTION)
        {
            if (wParam == WM_KEYDOWN)
                System.Console.Out.WriteLine("Key Down: " + lParam.vkCode);
            else if (wParam == WM_KEYUP)
                System.Console.Out.WriteLine("Key Up: " + lParam.vkCode);
        }
        return CallNextHookEx(Hook, nCode, wParam, lParam);
    }

public static bool RegisterHook()
    {
        lock (Lock)
        {
            if (IsRegistered)
                return true;
            Delegate = LowLevelKeyboardHandler;
            Hook = SetWindowsHookEx(
                WH_KEYBOARD_LL, Delegate,
                Marshal.GetHINSTANCE(
                    System.Reflection.Assembly.GetExecutingAssembly().GetModules()[0]
                ).ToInt32(), 0
            );

if (Hook != 0)
                return IsRegistered = true;
            Delegate = null;
            return false;
        }
    }

public static bool UnregisterHook()
    {
        lock (Lock)
        {
            return IsRegistered = (UnhookWindowsHookEx(Hook) != 0);
        }
    }
}

<h3>API/function hooking/interception using JMP instruction aka splicing</h3>
<p>The following source code is an example of an API/function hooking method which hooks by overwriting the first six bytes of a destination <a href="/facts/Subroutine/9vFJrg0A">function</a> with a <a href="/facts/JMP_(x86_instruction)/X9R7cC7m">JMP</a> instruction to a new function. The code is compiled into a <a href="/facts/Dynamic-link_library/vySyC1dz">DLL</a> file then loaded into the target process using any method of <a href="/facts/DLL_injection/XX8kNbrJ">DLL injection</a>. Using a backup of the original function one might then restore the first six bytes again so the call will not be interrupted. In this example the <a href="/facts/Win32_API/RRw4RtTu">win32 API</a> function MessageBoxW is hooked.<a class="footnote-ref" id="fnref:2" href="#fn:2"><sup>2</sup></a>
</p>
/*
 This idea is based on chrom-lib approach, Distributed under GNU LGPL License.
 Source chrom-lib: https://github.com/linuxexp/chrom-lib
 Copyright (C) 2011  Raja Jamwal
*/
#include <windows.h>  
#define SIZE 6

typedef int (WINAPI *pMessageBoxW)(HWND, LPCWSTR, LPCWSTR, UINT);  // Messagebox prototype
 int WINAPI MyMessageBoxW(HWND, LPCWSTR, LPCWSTR, UINT);            // Our detour

void BeginRedirect(LPVOID);                                        
 pMessageBoxW pOrigMBAddress = NULL;                                // address of original
 BYTE oldBytes[SIZE] = {0};                                         // backup
 BYTE JMP[SIZE] = {0};                                              // 6 byte JMP instruction
 DWORD oldProtect, myProtect = PAGE_EXECUTE_READWRITE;

INT APIENTRY DllMain(HMODULE hDLL, DWORD Reason, LPVOID Reserved)  
 {  
   switch (Reason)  
   {  
   case DLL_PROCESS_ATTACH:                                        // if attached
     pOrigMBAddress = (pMessageBoxW)                      
       GetProcAddress(GetModuleHandleA("user32.dll"),              // get address of original 
               "MessageBoxW");  
     if (pOrigMBAddress != NULL)  
       BeginRedirect(MyMessageBoxW);                               // start detouring
     break;

case DLL_PROCESS_DETACH:  
     VirtualProtect((LPVOID)pOrigMBAddress, SIZE, myProtect, &oldProtect);   // assign read write protection
     memcpy(pOrigMBAddress, oldBytes, SIZE);                                 // restore backup
     VirtualProtect((LPVOID)pOrigMBAddress, SIZE, oldProtect, &myProtect);   // reset protection

case DLL_THREAD_ATTACH:  
   case DLL_THREAD_DETACH:  
     break;  
   }  
   return TRUE;  
 }

void BeginRedirect(LPVOID newFunction)  
 {  
   BYTE tempJMP[SIZE] = {0xE9, 0x90, 0x90, 0x90, 0x90, 0xC3};              // 0xE9 = JMP 0x90 = NOP 0xC3 = RET
   memcpy(JMP, tempJMP, SIZE);                                             // store jmp instruction to JMP
   DWORD JMPSize = ((DWORD)newFunction - (DWORD)pOrigMBAddress - 5);       // calculate jump distance
   VirtualProtect((LPVOID)pOrigMBAddress, SIZE,                            // assign read write protection
           PAGE_EXECUTE_READWRITE, &oldProtect);  
   memcpy(oldBytes, pOrigMBAddress, SIZE);                                 // make backup
   memcpy(&JMP[1], &JMPSize, 4);                                           // fill the nop's with the jump distance (JMP,distance(4bytes),RET)
   memcpy(pOrigMBAddress, JMP, SIZE);                                      // set jump instruction at the beginning of the original function
   VirtualProtect((LPVOID)pOrigMBAddress, SIZE, oldProtect, &myProtect);   // reset protection
 }

int WINAPI MyMessageBoxW(HWND hWnd, LPCWSTR lpText, LPCWSTR lpCaption, UINT uiType)  
 {  
   VirtualProtect((LPVOID)pOrigMBAddress, SIZE, myProtect, &oldProtect);   // assign read write protection
   memcpy(pOrigMBAddress, oldBytes, SIZE);                                 // restore backup
   int retValue = MessageBoxW(hWnd, lpText, lpCaption, uiType);            // get return value of original function
   memcpy(pOrigMBAddress, JMP, SIZE);                                      // set the jump instruction again
   VirtualProtect((LPVOID)pOrigMBAddress, SIZE, oldProtect, &myProtect);   // reset protection
   return retValue;                                                        // return original return value
 }

<h3>Netfilter hook</h3>
<p>This example shows how to use hooking to alter <a href="/facts/Computer_network/3w5RM99p">network</a> traffic in the Linux kernel using <a href="/facts/Netfilter/M3rtyl3r">Netfilter</a>.
</p>
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/skbuff.h>

#include <linux/ip.h>
#include <linux/tcp.h>
#include <linux/in.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>

/* Port we want to drop packets on */
static const uint16_t port = 25;

/* This is the hook function itself */
static unsigned int hook_func(unsigned int hooknum,
                       struct sk_buff **pskb,
                       const struct net_device *in,
                       const struct net_device *out,
                       int (*okfn)(struct sk_buff *))
{
        struct iphdr *iph = ip_hdr(*pskb);
        struct tcphdr *tcph, tcpbuf;

if (iph->protocol != IPPROTO_TCP)
                return NF_ACCEPT;

tcph = skb_header_pointer(*pskb, ip_hdrlen(*pskb), sizeof(*tcph), &tcpbuf);
        if (tcph == NULL)
                return NF_ACCEPT;

return (tcph->dest == port) ? NF_DROP : NF_ACCEPT;
}

/* Used to register our hook function */
static struct nf_hook_ops nfho = {
        .hook     = hook_func,
        .hooknum  = NF_IP_PRE_ROUTING,
        .pf       = NFPROTO_IPV4,
        .priority = NF_IP_PRI_FIRST,
};

static __init int my_init(void)
{
        return nf_register_hook(&nfho);
}

static __exit void my_exit(void)
{
    nf_unregister_hook(&nfho);
}

module_init(my_init);
module_exit(my_exit);

<h3>Internal IAT hooking</h3>
<p>The following code demonstrates how to hook functions that are imported from another module.
This can be used to hook functions in a different process from the calling process. For this the code must be compiled into a <a href="/facts/Dynamic-link_library/vySyC1dz">DLL</a> file then loaded into the target process using any method of <a href="/facts/DLL_injection/XX8kNbrJ">DLL injection</a>.
The advantage of this method is that it is less detectable by <a href="/facts/Antivirus_software/GGMqsfkJ">antivirus software</a> and/or <a href="/facts/Anti-cheat_software/d35LUsrP">anti-cheat software</a>, one might make this into an external hook that doesn't make use of any malicious calls. 
The <a href="/facts/Portable_Executable/pJy7AkuY">Portable Executable</a> header contains the <a href="/facts/Import_Address_Table/pJy7AkuY">Import Address Table</a> (IAT), which can be manipulated as shown in the source below. The source below runs under Microsoft Windows.
</p>
#include <windows.h>

typedef int(__stdcall *pMessageBoxA) (HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType); //This is the 'type' of the MessageBoxA call.
pMessageBoxA RealMessageBoxA; //This will store a pointer to the original function.

void DetourIATptr(const char* function, void* newfunction, HMODULE module);

int __stdcall NewMessageBoxA(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType) { //Our fake function
    printf("The String Sent to MessageBoxA Was : %s\n", lpText);
    return RealMessageBoxA(hWnd, lpText, lpCaption, uType); //Call the real function
}

int main(int argc, CHAR *argv[]) {
   DetourIATptr("MessageBoxA",(void*)NewMessageBoxA,0); //Hook the function
   MessageBoxA(NULL, "Just A MessageBox", "Just A MessageBox", 0); //Call the function -- this will invoke our fake hook.
   return 0;
}

void **IATfind(const char *function, HMODULE module) { //Find the IAT (Import Address Table) entry specific to the given function.
	int ip = 0;
	if (module == 0)
		module = GetModuleHandle(0);
	PIMAGE_DOS_HEADER pImgDosHeaders = (PIMAGE_DOS_HEADER)module;
	PIMAGE_NT_HEADERS pImgNTHeaders = (PIMAGE_NT_HEADERS)((LPBYTE)pImgDosHeaders + pImgDosHeaders->e_lfanew);
	PIMAGE_IMPORT_DESCRIPTOR pImgImportDesc = (PIMAGE_IMPORT_DESCRIPTOR)((LPBYTE)pImgDosHeaders + pImgNTHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);

if (pImgDosHeaders->e_magic != IMAGE_DOS_SIGNATURE)
		printf("libPE Error : e_magic is no valid DOS signature\n");

for (IMAGE_IMPORT_DESCRIPTOR *iid = pImgImportDesc; iid->Name != NULL; iid++) {
		for (int funcIdx = 0; *(funcIdx + (LPVOID*)(iid->FirstThunk + (SIZE_T)module)) != NULL; funcIdx++) {
			char *modFuncName = (char*)(*(funcIdx + (SIZE_T*)(iid->OriginalFirstThunk + (SIZE_T)module)) + (SIZE_T)module + 2);
			const uintptr_t nModFuncName = (uintptr_t)modFuncName;
			bool isString = !(nModFuncName & (sizeof(nModFuncName) == 4 ? 0x80000000 : 0x8000000000000000));
			if (isString) {
				if (!_stricmp(function, modFuncName))
					return funcIdx + (LPVOID*)(iid->FirstThunk + (SIZE_T)module);
			}
		}
	}
	return 0;
}

void DetourIATptr(const char *function, void *newfunction, HMODULE module) {
	void **funcptr = IATfind(function, module);
	if (*funcptr == newfunction)
		 return;

DWORD oldrights, newrights = PAGE_READWRITE;
	//Update the protection to READWRITE
	VirtualProtect(funcptr, sizeof(LPVOID), newrights, &oldrights);

RealMessageBoxA = (pMessageBoxA)*funcptr; //Some compilers require the cast (like "MinGW"), not sure about MSVC though
	*funcptr = newfunction;

//Restore the old memory protection flags.
	VirtualProtect(funcptr, sizeof(LPVOID), oldrights, &newrights);
}

<h2 id="see-also">See also</h2>
<ul><li><a href="/facts/Callback_(computer_science)/vPlrCJXG">Callback (computer science)</a></li>
<li><a href="/facts/Delegation_(programming)/fhoIL7nh">Delegation (programming)</a></li>
<li><a href="/facts/Terminate-and-stay-resident_program/6croHFxf">Terminate-and-stay-resident program</a></li>
<li><a href="/facts/User_exit/a0joagW8">User exit</a></li>
<li><a href="/facts/WinAPIOverride32/HTCRC8ok">WinAPIOverride32</a></li></ul>

<ul><li>Jonathan Daniel (2013-11-27). <a href="http://ntvalk.blogspot.nl/2013/11/hooking-explained-detouring-library.html">"Hooking explained: detouring library calls and vtable patching in Windows/Linux/MAC-OSX"</a>. Retrieved 2014-01-01.</li>
<li>Binh Nguyen (2004-08-16). <a href="http://www.tldp.org/LDP/Linux-Dictionary/html/">"Hacking-Lexicon / Linux Dictionary V 0.16"</a>. Retrieved 2008-02-23. Hook</li>
<li> [2012-06-29:  Link appears to be dead]  Author: Holy Father (2002-06-10). <a href="https://web.archive.org/web/20091229043254/http://www.codebreakers-journal.com/downloads/cbj/2004/CBJ_1_2_2004_HolyFather_Hooking_Windows_API.pdf">"Hooking Windows API - Technics of hooking API functions on Windows 1.1 english"</a> (PDF). Archived from <a href="http://www.codebreakers-journal.com/downloads/cbj/2004/CBJ_1_2_2004_HolyFather_Hooking_Windows_API.pdf">the original</a> (PDF) on 2009-12-29. Retrieved 2008-02-21. {{cite web}}: |author= has generic name (help)</li></ul>

<h2 id="external-links">External links</h2>
<h3>Windows</h3>
<ul><li><a href="http://sandsprite.com/CodeStuff/IAT_Hooking.html">Information on Import Address Table function hooking.</a></li>
<li><a href="http://msdn.microsoft.com/en-us/library/ms632589(VS.85).aspx">Information from Microsoft on hooking</a></li>
<li><a href="http://jbremer.org/x86-api-hooking-demystified/">Information and various techniques regarding x86 hooking.</a></li>
<li><a href="http://www.internals.com/">APISpy32</a> is an application used to hook win32 API.</li>
<li><a href="http://research.microsoft.com/sn/detours">Detours</a> is a general purpose function hooking library created by Microsoft Research which works in C / C++.</li>
<li><a href="http://www.codeproject.com/KB/threads/winspy.aspx">winspy</a> Three ways to inject code into another process.</li>
<li><a href="http://www.codeproject.com/KB/system/hooksys.aspx">HookTool SDK (ACF SDK)</a> Provides a comprehensive overview on API hooking and code injection. A commercial product available too.</li>
<li><a href="http://help.madshi.net/ApiCodeHooking.htm">madCodeHook</a> is a commercial x86 and x64 API hooking and DLL injection library for C++ and Delphi.</li>
<li><a href="https://easyhook.github.io/">EasyHook</a> is an open source hooking engine supporting x86 and x64 in Windows in both user and kernel land.</li>
<li><a href="http://www.nektra.com/products/spystudio-api-monitor/">SpyStudio Application Trace</a> SpyStudio is an Application tracer which hook calls, displaying the results in a structured way.</li>
<li><a href="http://www.rohitab.com/apimonitor">rohitab.com API Monitor</a> is a freeware application that can hook and display 10,000+ Windows APIs and COM Interfaces in 32-bit and 64-bit applications and services.</li>
<li><a href="http://www.nektra.com/products/deviare-api-hook-windows/">Deviare API Hook</a> Deviare is a freeware inter-process hook framework that can be used to intercept other processes' API calls and show full-parameter information or create API monitors.</li>
<li><a href="http://jacquelin.potier.free.fr/winapioverride32/">WinAPIOverride</a> WinAPIOverride is a freeware for non commercial use. It can hook win32 API, COM, OLE, ActiveX, .NET in 32-bit and 64-bit processes. It includes monitoring post analysis tools.</li>
<li><a href="https://github.com/urShadow/urmem">urmem</a> C++11 cross-platform library (x86) for working with memory (hooks, patches, pointer's wrapper, signature scanner etc.)</li></ul>
<h3>Linux</h3>
<ul><li><a href="https://web.archive.org/web/20070610083142/http://rtg.informatik.tu-chemnitz.de/docs/da-sa-txt/sa-dienelt.pdf">[1]</a> A student research project that utilizes hooking.</li>
<li><a href="https://web.archive.org/web/20090317112907/http://www.linuxmanpages.com/man2/ptrace.2.php">[2]</a> Functionality that allows a piece of software to observe and control the execution of another process.</li>
<li><a href="https://securityvulns.ru/articles/reveng/">[3]</a> Use of LD_PRELOAD to hook shared library calls.</li></ul>
<h3>Emacs</h3>
<ul><li><a href="https://www.gnu.org/software/emacs/manual/html_node/emacs/Hooks.html">Emacs Hooks</a> Hooks are an important mechanism for customization of Emacs. A hook is a Lisp variable which holds a list of functions, to be called on some well-defined occasion. (This is called running the hook.)</li></ul>
<h3>OS X and iOS</h3>
<ul><li><a href="http://cydiasubstrate.com">Cydia Substrate</a> is a framework for jailbroken iOS devices allowing developers to hook into any other framework or application.</li>
<li><a href="https://github.com/jndok/harpoon">harpoon</a> is an OS X library for runtime function hooking.</li></ul>
<h3>In Depth API Hooking</h3>
<ul><li><a href="http://jbremer.org/x86-api-hooking-demystified/">x86 API Hooking Demystified</a> Article on various API Hooking methods, for the x86 architecture.</li></ul>

<h2 id="references">References</h2>

<ol>
<li id="fn:1"><p>psyfl <a href="https://github.com/psyfl/Virtual-Method-Table-Hooking/blob/master/ConsoleApplication5/ConsoleApplication5.cpp" target="_blank">https://github.com/psyfl/Virtual-Method-Table-Hooking/blob/master/ConsoleApplication5/ConsoleApplication5.cpp</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li>
<li id="fn:2"><p>For more information, see http://ntvalk.blogspot.nl/2013/11/hooking-explained-detouring-library.html <a href="http://ntvalk.blogspot.nl/2013/11/hooking-explained-detouring-library.html" target="_blank">http://ntvalk.blogspot.nl/2013/11/hooking-explained-detouring-library.html</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li>
</ol>

Hooking open-in-new

Hooking