iqiyi/xHook
XHook
xHook is a low-level instrumenter and hooking library for Android ELF binaries. It functions as a framework for intercepting native symbols and redirecting function calls by modifying the procedure linkage table.
The tool utilizes regular expressions to filter specific binary files and symbols for interception. It enables the redirection of native calls toward custom function implementations without altering the original binary files.
The framework covers dynamic symbol resolution, ELF table modification, and security analysis of native libraries. It also includes stability mechanisms that use signal handlers to intercept segmentation faults and prevent application crashes during pointer calculations.
Features
- PLT Hooking - Intercepts native functions by patching the Procedure Linkage Table in compiled Android binaries.
- Native Function Interception - Provides the ability to intercept internal native function calls to redirect execution flow for data capture or manipulation.
- Native Hooking Libraries - Provides a specialized library for intercepting and redirecting native function calls in Android ELF binaries.
- Android Hooking Frameworks - Provides a toolkit for intercepting and redirecting native layer functions to modify Android application behavior at runtime.
- Executable File Modifications - Modifies the structural relocation and linkage sections of ELF binaries to alter program execution flow.
- Symbol Interception - Implements runtime redirection of native function calls by replacing symbols in the procedure linkage table.
- Binary Instrumentation - Injects diagnostic and monitoring code into Android native binaries to change execution flow.
- Android ELF Instrumenters - Functions as a low-level instrumenter for modifying the execution flow of Android native binaries.
- Runtime Symbol Resolution - Locates memory addresses of native functions by resolving symbols across compiled modules during program execution.
- Function Redirection - Implements techniques for altering the call path of native functions by modifying the procedure linkage table.
- Runtime Crash Prevention - Intercepts internal memory errors via signal handlers to prevent the host process from terminating.
- Symbol Filtering - Uses regular expressions to include or exclude specific binary symbols during the hooking process.
- Signal Handlers - Utilizes system signal handlers to intercept segmentation faults and maintain process stability during pointer calculations.
- Native Crash Protection - Intercepts native memory access errors to prevent application crashes in production environments.
- Android Native Library Analysis - Enables security analysis of native libraries by replacing target symbols to observe data flow.
- Symbol Filtering Patterns - Employs regular expression matching to isolate specific binary files and symbols for interception.
- Android Hooking Frameworks - PLT hook library for Android native ELF binaries.
