Open-source alternatives to XHook

Dexposed is a set of runtime tools and engines designed for dynamic patching, framework interception, and code instrumentation on Android devices. It functions as a hooking framework and instrumentation tool used to load custom code into running processes to alter logic without modifying the original bytecode. The project enables the interception and modification of method behavior within both Android applications and the system framework. It specifically provides capabilities for bypassing operating system limitations by overriding framework calls and applying hot patches to live processes w

Xposed is a native Android runtime hooking framework and instrumentation tool. It provides a modified version of the Android app process binary to intercept and modify the behavior of system and application processes at the binary level. The framework enables Android operating system customization by altering internal function calls and runtime execution flow. It achieves this through native process instrumentation, allowing for the modification of functionality without altering original application files. The tool covers several low-level capabilities, including native library injection and

Matrix is a suite of mobile application performance management and analysis tools. It provides a plugin-based monitoring system for capturing crashes, lags, and memory leaks, alongside a static binary auditor for reducing installation package size and a bytecode instrumentation tool for performance tracking. The project distinguishes itself through native memory debugging and a SQLite query linter that identifies inefficient database patterns. It employs native interception techniques to detect memory leaks and heap corruption without requiring source code recompilation, and uses a custom run

Geode is a game modification SDK and mod loader for Geometry Dash. It functions as a hooking engine and UI framework that allows for the injection of dynamic libraries to alter game behavior and add new features. The toolkit distinguishes itself through a centralized mod compatibility manager and hook registry that tracks active modifications to prevent logic conflicts and application crashes. It utilizes a trampoline-based hooking engine to redirect game function calls while preserving native call stacks, alongside a dedicated UI framework for rendering custom popups and interface components

VirtualApp is an Android application virtualization engine and user-space sandbox that enables the execution of applications within an isolated environment. It allows for the running of multiple independent instances of the same application on a single device and supports private application installation without requiring system-level root access. The project features a comprehensive hooking framework for intercepting Java and native layer functions to modify application behavior. It includes tools for hardware simulation to spoof device models and system information, as well as a non-root pr

go-fuzz is a coverage-guided randomized testing tool for identifying crashes and logic bugs in Go code. It consists of a fuzzer that evolves random inputs based on code execution paths, an instrumentation tool that produces binaries for tracking coverage, and a seed corpus manager. The tool utilizes compile-time binary instrumentation to monitor branch coverage and employs a feedback-driven mutation loop to prioritize inputs that reach new sections of the codebase. It includes capabilities for comparative differential testing to identify logic errors by executing different implementations of

Fishhook is a binary instrumentation library for iOS and iOS simulators. It functions as a Mach-O symbol rebinder and instrumenter, allowing for the replacement of system library implementations with custom logic at runtime. The project redirects function calls by updating lazy and non-lazy symbol pointers within Mach-O binary data segments. This approach enables the interception and modification of existing function behavior without altering the original binary on disk. The toolset covers binary instrumentation and dynamic hooking for iOS applications, facilitating the monitoring and altera

AFL is a coverage-guided fuzzer and security vulnerability scanner used to identify software bugs and memory corruption by feeding programs mutated data. It functions as a binary instrumentation tool and a test case minimizer to locate crashes and isolate the smallest set of bytes causing a fault. The project distinguishes itself through its ability to operate as a parallel fuzzing orchestrator, distributing workloads across multiple CPU cores or networked machines. It utilizes dictionary-based mutation for complex file formats and performs input sensitivity analysis to identify critical sect

This project is a comprehensive software fuzzing knowledge base and technical guide designed for discovering software bugs and vulnerabilities. It serves as a resource for implementing coverage-guided, structure-aware, and hybrid fuzzing across various targets, including compiled binaries and hardware kernels. The resource provides specialized guidance on using grammars and defined data formats to generate syntactically valid inputs for complex APIs. It also details methods for combining grey-box fuzzing with symbolic execution to reach deep execution paths and utilizes binary instrumentation

This project is a suite of runtime diagnostic tools designed to detect memory leaks, concurrency races, and language-specification violations during software execution. It provides a collection of dynamic analysis tools that identify addressability issues, uninitialized memory usage, and memory safety bugs in applications. The toolset includes a thread safety analyzer to identify data races and deadlocks in concurrent code, as well as an undefined behavior sanitizer to detect operations that violate language specifications. The system covers broad capabilities in memory safety monitoring and

PE-bear is a graphical portable executable analysis tool designed for inspecting, disassembling, and modifying the structure of Windows PE binary files. It functions as a static analysis framework used to identify malicious patterns and reverse engineer program logic. The project provides a binary diffing tool to identify structural and content differences between two executable files. It also includes a section editor for modifying binary layouts by adding or altering sections and imports. The tool covers a range of binary analysis capabilities, including machine code disassembly, file layo

Janet is a Lisp-based dynamic programming language featuring a register-based bytecode virtual machine and an embeddable scripting engine. It functions as a fiber-based concurrency runtime and includes a parsing engine based on Parsing Expression Grammars. The project is distinguished by its ability to be integrated into C or C++ applications via a minimal header interface. It utilizes a Lisp-style macro system for compile-time code transformation and employs prototype-based table inheritance for object-oriented behavior. The runtime covers a broad set of capabilities, including asynchronous

WeChatOpenDevTools-Python is a set of software utilities designed to bypass environment restrictions to enable debugging and element inspection for web and mini program applications. It functions as a developer tool unlocker and web inspector activator to force the activation of integrated inspection tools. The project provides specialized capabilities for debugging and reverse engineering WeChat mini programs. This includes the ability to access hidden developer consoles to analyze the structure, network requests, and behavior of active mini programs and web content. These utilities utilize

PINCE is a dynamic debugger, instruction tracer, and memory scanner designed for the analysis and manipulation of running processes. It functions as a process memory manipulator and editor, allowing for the identification, modification, and monitoring of values within a target application's active memory. The tool distinguishes itself through memory pointer analysis, tracing addresses and offsets to locate static pointers that lead to dynamic data across different sessions. It also enables the execution of internal functions within a running process by manipulating the instruction pointer and

WeChatFerry is a platform-specific automation tool designed for programmatic account and conversation management. It enables the creation of bots and the integration of large language models to provide automated replies within a messaging interface. The project functions by using native API interception and memory-based hooking to capture incoming communication and send messages without an official API. It includes capabilities for binary data decryption to transform protected media files and database records into readable formats. The system covers a broad range of functional areas, includi

LIEF is a framework for parsing, modifying, and analyzing executable binary formats and system shared caches across multiple platforms. It serves as a cross-platform library for the programmatic manipulation of ELF, PE, and MachO binary files. The project provides tools for altering the internal structure and sections of executable files to change program behavior. It also includes a dedicated parser for recovering individual dynamic libraries from combined system shared caches. The toolset covers binary executable analysis, machine code disassembly, and the extraction of debug metadata and

LSPosed_mod is a system for Android system hooking and module management. It enables the installation and configuration of system-level modifications to change device behavior without altering the original system image or source files. The project utilizes zygote-based process injection and runtime method hooking to intercept execution flows in memory. It includes a version-agnostic execution layer to maintain a consistent interface across different Android operating system versions and environments, as well as dynamic proxy interception to modify method arguments and return values. Manageme

ReZygisk is an Android root module framework and Zygote process injector. It functions as a native hooking engine and linker redirection tool designed to inject custom code into the Android Zygote process so that modifications are inherited by all spawned applications. The project provides a decoupled abstraction layer and Zygisk API implementation, allowing system modules to operate independently of specific root management tools. This ensures that root modules remain stable and compatible across various kernel-level rooting solutions. The framework includes capabilities for system process

A True Instrumentable Binary Emulation Framework

XposedBridge is an Android Java hooking framework and bytecode instrumentation engine. It functions as a runtime system for intercepting and modifying Java method calls within the Android operating system and installed applications. The project provides a mechanism for zygote process injection, ensuring that all spawned applications inherit the instrumentation logic. It enables the modification of internal Android system behaviors through method proxying and Java reflection to access private internal system members. The framework supports dynamic Android instrumentation and runtime analysis,

Objection is a dynamic instrumentation framework and runtime exploration toolkit for mobile application security analysis. It provides a command-line interface to interact with the memory and state of iOS and Android applications during active execution, serving as a toolkit for runtime analysis and security testing. The project distinguishes itself by providing specialized capabilities to bypass common mobile security controls, including SSL pinning, biometric authentication, and root or jailbreak detection. It enables the extraction of sensitive credentials and data from secure storage syst

Epic is a toolkit for Android runtime instrumentation, method interception, and security posture auditing. It functions as an aspect-oriented programming framework and a dynamic method interceptor designed to monitor and alter the behavior of Java methods within the Android Runtime. The project provides capabilities for intercepting and modifying both core Android framework components and specific application logic. This allows for the injection of custom Java behavior and the redirection of method execution without altering the original source code. The framework includes tools for applicat

Yaegi is a Go language interpreter and embedded scripting engine that executes Go source code at runtime without requiring a separate compilation step. It provides a mechanism for evaluating Go expressions and files dynamically, functioning as both a library for compiled applications and a standalone read-eval-print-loop environment. The project enables the integration of dynamic Go scripts into compiled programs to allow for runtime extensibility and plugin development. It facilitates the conversion of interpreted symbols from evaluated scripts into usable interfaces and types within a compi

Proxychains-ng is a utility for POSIX-compliant systems that redirects network traffic and domain name lookups through proxy chains. It functions by intercepting system calls and forcing outgoing TCP connections through a sequence of SOCKS4, SOCKS5, or HTTP proxies without requiring modifications to the target application source code. The tool distinguishes itself by utilizing dynamic library preloading to override standard network functions, allowing it to wrap socket-level traffic and route it through multiple intermediate servers. It supports various routing strategies, including strict, r

Angr is a binary analysis framework and static analysis tool used for reverse engineering compiled binaries. It serves as a binary decompiler and a lifting platform that translates machine code into a common intermediate representation to enable cross-architecture analysis. The framework integrates a symbolic execution engine and constraint solvers to determine the inputs required to reach specific program states. It also employs untrusted code sandboxing to isolate guest code from the host environment during analysis. Its capabilities cover control flow and data flow analysis, including the

Emscripten is a WebAssembly toolchain and compiler backend that transforms C and C++ source code into WebAssembly bytecode. It serves as a framework for porting native applications and libraries to web browsers and server runtimes by translating LLVM intermediate representation into optimized WebAssembly modules. The system specializes in porting native graphical standards, such as OpenGL and SDL2, by mapping native graphics API calls to browser-compatible WebGL commands. This allows complex visual applications and native desktop software to be deployed as portable web formats. The toolchain

AsmJit is a runtime machine code generator and JIT compiler backend that translates high-level definitions into executable processor instructions. It provides a unified instruction emission API and an executable memory manager to allocate and protect virtual memory pages across multiple CPU architectures. The library functions as an assembly engine for x86 and ARM, supporting cross-platform assembly generation through a unified backend. It enables the creation of optimized machine code for different CPUs while maintaining a single codebase. The project covers low-level system abstractions in