DOCSEARCHbyAlgolia
Submit Docs

PolyHook 2.0 Documentation

repository·master·Indexed 23 days ago

https://github.com/stevemk14ebr/polyhook_2_0

A high-performance C++20 hooking library for x86 and x64 architectures. PolyHook 2.0 supports various interception techniques, including inline detours, runtime inline hooks, VTable and VFunc swapping, software and hardware breakpoint hooks, and IAT/EAT hooking.

Tokens
887
Snippets
1
Records
4
Agent score
34%

What's inside PolyHook 2.0

  1. Overview of PolyHook 2 hooking techniques

    master

    PolyHook 2 provides several distinct methods for intercepting execution, depending on your requirements:

    • Inline Hook (x86/x64 Detour): Places a jmp at the function prologue to a callback and uses a trampoline to continue execution. It handles complex relocation of position-dependent code and supports cross-architecture hooking (e.g., 32-bit process hooking 64-bit memory).
    • Runtime Inline Hook: Similar to Inline Hook, but JITs a translation stub compatible with a given typedef and ABI. This allows hooking functions where the typedef is only known at runtime.
    • Virtual Function Swap (VFuncSwap): Swaps pointers at specific indices in a C++ VTable to point to callbacks.
    • Virtual Table Swap (VTableSwap): Performs a deep copy of a C++ VTable, replaces the pointer to the table with the new copy, and swaps entries in the copy.
    • Software Breakpoint Hook (BreakpointHook): Overwrites the first byte of a function with 0xCC and uses an exception handler to trigger the callback.
    • Hardware Breakpoint Hook (HWBreakpointHook): Uses CPU debug registers. Warning: Hardware breakpoints are per-thread; the thread calling hook() must be the same thread being hooked.
    • Import Address Table Hook (IatHook): Resolves modules via PEB and swaps the IAT thunk pointer to the callback.
    • Export Address Table Hook (EatHook): Resolves modules via PEB and swaps the EAT pointer to the callback.

  2. Use PolyHook 2 with Visual Studio 2022 (CMake)

    master

    PolyHook 2 supports the Visual Studio 2022 CMake environment. Instead of running CMake commands manually from the CLI, follow these steps:

    1. Clone the project and initialize submodules as described in the manual build guide.
    2. Open Visual Studio 2022.
    3. Go to File -> Open -> Folder... (or File -> Open -> CMake...) and select the project folder. This will trigger CMake generation.
    4. Use CMake -> Build All or CMake -> Build to compile.
    5. You can also set a startup item and use Release mode with the 'Play' button.

    Note: You do not need to build Capstone, Zydis, or asmjit separately; they are configured to build and link automatically. Do not use the 'install' target within the VS interface.

  3. Install PolyHook 2 via vcpkg

    master

    You can install PolyHook 2 using the vcpkg package manager. First, ensure vcpkg is installed and integrated into your environment. Then, use the following commands to install the appropriate version for your target architecture (x86 or x64). After installation, include the PolyHook headers in your project and link against the generated .lib files.

    # Install vcpkg (if not already installed)
λ git clone https://github.com/Microsoft/vcpkg.git
λ cd vcpkg
λ .\bootstrap-vcpkg.bat -disableMetrics
λ (as admin) .\vcpkg integrate install

# For x86:
λ vcpkg.exe install polyhook2:x86-windows-static polyhook2:x86-windows

# For x64:
λ vcpkg.exe install polyhook2:x64-windows-static polyhook2:x64-windows

  4. Build PolyHook 2 manually from source

    master

    To build PolyHook 2 manually, use CMake. This project requires submodules (Capstone, Zydis, asmjit) to be initialized. You can choose between a dynamic build (Shared Library/DLL) or a static build.

    Note: If you are switching between shared and static builds, ensure you clear your CMake cache first.