C++ 20, x86/x64 Hooking Libary v2.0
Article 1: https://www.codeproject.com/articles/1100579/polyhook-the-cplusplus-x-x-hooking-library
Article 2: https://www.codeproject.com/Articles/1252212/PolyHook-2-Cplusplus17-x86-x64-Hooking-Library
Dynamic Re-Writing: https://twitter.com/stevemk14ebr/status/1518621861692817409
Ask for help, chat with others, talk to me here
PolyHook2 is available on vcpkg. Consider trying that installation method if you prefer. Just install vcpkg from microsofts directions:
Commands:
λ git clone https://github.com/Microsoft/vcpkg.git
λ cd vcpkg
λ .\bootstrap-vcpkg.bat -disableMetrics
λ (as admin) .\vcpkg integrate install
For x86:
λ vcpkg.exe install polyhook2:x86-windows-static polyhook2:x86-windows
For x64:
λ vcpkg.exe install polyhook2:x64-windows-static polyhook2:x64-windows
You then simply include the polyhook headers, be sure to link the generated .lib.
See: https://github.com/stevemk14ebr/PolyHook_2_0/pull/59#issuecomment-619223616
λ git clone --recursive https://github.com/stevemk14ebr/PolyHook_2_0.git
λ cd PolyHook_2_0
λ git submodule update --init --recursive
λ (dynamic build) cmake -B"./_build" -DCMAKE_INSTALL_PREFIX="./_install/" -DPOLYHOOK_BUILD_SHARED_LIB=ON
λ (static build) cmake -B"./_build" -DCMAKE_INSTALL_PREFIX="./_install/" -DPOLYHOOK_BUILD_SHARED_LIB=OFF
λ cmake --build "./_build" --config Release --target install
I provide directions below for how to setup the visual studio cmake environment only. If you don't want to use visual studio that's fine, this is a standard cmake project and will build from command line just fine.
An up to date visual studio is required. First clone the project and perform submodule init as above. Do not run the cmake commands, instead:
Open VS 2022, go to file->open->cmake.. this will load the project and start cmake generation. Next goto cmake->build all or cmake->build, you can also set a startup item and release mode to use the play button (do not use the install target). Capstone, Zydis, and asmjit are set to automatically build and link, you DO NOT need to build them seperately.
https://stevemk14ebr.github.io/PolyHook_2_0/ & Read the Tests!
I've setup an example project to show how to use this as a static library. You should clear your cmake cache between changing these options. The dll is built with the cmake option to export all symbols. This is different from the typical windows DLL where things are manually exported via declspec(dllexport), instead it behaves how linux dlls do with all symbols exported by default. This style should make it easier to maintain the code, the downside is there are many exports but i don't care.
0) Both capstone and zydis are supported as disassembly backends and are fully abstracted. 1) Inline hook (x86/x64 Detour)
Effecient reHook-ing logic is implemented. This can be used to combat third parties overwriting prologues back to original bytes. This is optimized into a few simple memcpy's rather than re-executing the entire logic in hook().
2) Runtime Inline Hook
3) Virtual Function Swap (VFuncSwap)
Linux support. There is a partial unix implementation, but it is not well tested. Please contribute or report bugs.
MIT - Please consider donating
evolution536, DarthTon, IChooseYou on Unknowncheats.me
@Ochii & https://www.unknowncheats.me/forum/c-and-c/50426-eat-hooking-dlls.html for EAT implementation
https://github.com/DarthTon/Blackbone
https://www.codeproject.com/Articles/44326/MinHook-The-Minimalistic-x-x-API-Hooking-Libra
https://wiki.osdev.org/CPU_Registers_x86#Debug_Registers
https://reverseengineering.stackexchange.com/questions/14992/what-are-the-vectored-continue-handlers
https://github.com/odzhan/shellcode/blob/master/os/win/getapi/dynamic/getapi.c