A C++11 library providing abstract interfaces for multiple x86/x64 hooking techniques including detours, VEH, and IAT.
PolyHook is a C++11 library that provides an abstract interface for multiple hooking techniques on x86 and x64 architectures. It enables developers to intercept and redirect function calls in native applications, which is useful for debugging, monitoring, and modifying software behavior at a low level.
C++ developers working on reverse engineering, security research, debugging tools, or software instrumentation who need reliable and flexible hooking capabilities.
Developers choose PolyHook because it consolidates various hooking methods into a single, clean C++11 interface, supports both x86 and x64 architectures, and integrates with Capstone for advanced disassembly, reducing the complexity of implementing low-level hooks.
x86/x64 C++ Hooking Library
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Provides a single abstract C++11 interface for detour, VTable, IAT, and VEH hooks, simplifying code for multiple techniques as highlighted in the README's philosophy.
All hooking methods work on both x86 and x64 platforms, enabling consistent hooking across different Windows architectures, as stated in the README.
Leverages a modified Capstone branch for length disassembler support, allowing accurate code relocation for EIP/RIP relative instructions in detour hooks.
Supports diverse methods like virtual function pointer swaps and IAT hooks, catering to various interception needs for debugging and reverse engineering.
The README explicitly marks this version as 'OUTDATED' and directs users to V2, indicating potential unsupported issues and lack of recent fixes.
Relies on a modified Capstone branch from the author's GitHub, which may require manual integration and complicate build processes compared to standard libraries.
VEH hooks currently support only INT3 and guard page violations, with other exception generation methods 'in development,' restricting flexibility for advanced use cases.
Requires careful callback handling, such as calling GetProtectionObject inside the callback per the README example, adding complexity and risk of errors.