Awesome GitHub RepositoriesTrampoline-Based Hook Engines

Detours is a library for intercepting Win32 API calls and redirecting function calls at runtime on Windows, enabling binary-level instrumentation without requiring access to the original source code. It functions as an API hooking library and binary instrumentation toolkit, allowing developers to monitor or modify the behavior of compiled Windows binaries by hooking into their function execution paths. The project achieves this through detour-based function interception, where the first few instructions of a target function are replaced with a jump to a user-supplied detour function, while pr

Elder driver Xposed Framework.

Dobby est un framework de hooking de fonction dynamique et un outil d'instrumentation binaire conçu pour intercepter et rediriger les appels de fonction dans des binaires compilés. Il sert de bibliothèque multiplateforme et multi-architecture qui fournit une interface unifiée pour modifier le flux d'exécution des programmes à travers différents systèmes d'exploitation et architectures CPU. La bibliothèque permet l'instrumentation binaire de bas niveau et l'instrumentation d'application au moment de l'exécution en injectant des gestionnaires personnalisés dans des processus vivants. Elle est utilisée pour l'ingénierie inverse logicielle afin d'observer le flux de données en temps réel et la logique en hookant des fonctions internes. Le framework couvre le patch binaire, la résolution de symboles au moment de l'exécution et la génération de trampolines dynamiques. Il gère les protections mémoire spécifiques à la plateforme et mappe les requêtes de hook génériques en opcodes spécifiques à l'architecture pour rediriger l'exécution via un hooking basé sur les instructions.

LoadLibrary is a binary instrumentation framework that loads and executes Windows PE/COFF DLLs natively within Linux processes. It provides a cross-platform binary execution layer that maps Windows portable executable files into Linux memory, resolving imports and relocations so that exported functions can be called as if they were native Linux library routines. The framework enables runtime interception and modification of Windows DLL function behavior, including redirecting API calls to Linux-native implementations through a binary patching hook engine. It includes a code coverage auditor t

OffensiveNim is a red teaming framework and post-exploitation toolkit developed in Nim. It provides a collection of low-level primitives and a Windows API wrapper designed for offensive security operations, including malware development and shellcode loading. The project focuses on evasion and obfuscation through techniques such as API unhooking, direct system calls, and anti-debugging mechanisms. It features diverse payload delivery methods, including reflective binary loading, the execution of .NET assemblies via CLR hosting, and various shellcode injection techniques using fibers, COM obje

Geode is a game modification SDK and mod loader for Geometry Dash. It functions as a hooking engine and UI framework that allows for the injection of dynamic libraries to alter game behavior and add new features. The toolkit distinguishes itself through a centralized mod compatibility manager and hook registry that tracks active modifications to prevent logic conflicts and application crashes. It utilizes a trampoline-based hooking engine to redirect game function calls while preserving native call stacks, alongside a dedicated UI framework for rendering custom popups and interface components