Awesome GitHub RepositoriesTrampoline-Based Hook Engines

Detours is a library for intercepting Win32 API calls and redirecting function calls at runtime on Windows, enabling binary-level instrumentation without requiring access to the original source code. It functions as an API hooking library and binary instrumentation toolkit, allowing developers to monitor or modify the behavior of compiled Windows binaries by hooking into their function execution paths. The project achieves this through detour-based function interception, where the first few instructions of a target function are replaced with a jump to a user-supplied detour function, while pr

Elder driver Xposed Framework.

Dobby ist ein dynamisches Funktions-Hooking-Framework und ein Tool zur Binärinstrumentierung, das darauf ausgelegt ist, Funktionsaufrufe in kompilierten Binärdateien abzufangen und umzuleiten. Es dient als plattform- und architekturübergreifende Bibliothek, die eine einheitliche Schnittstelle zur Änderung des Programmablaufs über verschiedene Betriebssysteme und CPU-Architekturen hinweg bietet. Die Bibliothek ermöglicht Low-Level-Binärinstrumentierung und Laufzeit-Anwendungs-Instrumentierung durch das Injizieren benutzerdefinierter Handler in laufende Prozesse. Sie wird für Software-Reverse-Engineering verwendet, um den Datenfluss und die Logik in Echtzeit zu beobachten, indem interne Funktionen gehookt werden. Das Framework deckt Binär-Patching, Laufzeit-Symbolauflösung und die Generierung dynamischer Trampolines ab. Es verwaltet plattformspezifische Speicherschutzmechanismen und bildet generische Hook-Anfragen auf architekturspezifische Opcodes ab, um die Ausführung via instruktionsbasiertem Hooking umzuleiten.

LoadLibrary is a binary instrumentation framework that loads and executes Windows PE/COFF DLLs natively within Linux processes. It provides a cross-platform binary execution layer that maps Windows portable executable files into Linux memory, resolving imports and relocations so that exported functions can be called as if they were native Linux library routines. The framework enables runtime interception and modification of Windows DLL function behavior, including redirecting API calls to Linux-native implementations through a binary patching hook engine. It includes a code coverage auditor t

OffensiveNim is a red teaming framework and post-exploitation toolkit developed in Nim. It provides a collection of low-level primitives and a Windows API wrapper designed for offensive security operations, including malware development and shellcode loading. The project focuses on evasion and obfuscation through techniques such as API unhooking, direct system calls, and anti-debugging mechanisms. It features diverse payload delivery methods, including reflective binary loading, the execution of .NET assemblies via CLR hosting, and various shellcode injection techniques using fibers, COM obje

Geode is a game modification SDK and mod loader for Geometry Dash. It functions as a hooking engine and UI framework that allows for the injection of dynamic libraries to alter game behavior and add new features. The toolkit distinguishes itself through a centralized mod compatibility manager and hook registry that tracks active modifications to prevent logic conflicts and application crashes. It utilizes a trampoline-based hooking engine to redirect game function calls while preserving native call stacks, alongside a dedicated UI framework for rendering custom popups and interface components