Dynamic Instrumentation Hooking Frameworks

LSPosed is an Android runtime hooking framework and in-memory code modifier. It functions as a system hooking tool that intercepts and modifies system and application methods in memory to change behavior without altering original installation files. The project provides a standardized interface through the Xposed Module API, allowing for the development of plugins that alter the behavior of the Android operating system and installed applications. The framework covers a range of capabilities including runtime function interception, Android system debugging, and application customization. Thes

Frida is a dynamic binary instrumentation toolkit that provides a framework for deep process introspection and live application state manipulation. It enables the injection of custom scripts into running processes to trace function calls, modify memory, and analyze application behavior in real-time across diverse operating systems and processor architectures. The project distinguishes itself by embedding a high-performance JavaScript engine directly within the target process, allowing for the execution of user-defined logic for real-time inspection. It utilizes instruction-level hooking to re

Harmony is a library for modifying, replacing, and decorating compiled .NET and Mono methods during execution without altering binary files on disk. It functions as a runtime method patching tool, a CIL instruction manipulator, and a reflection extension for C#. The project provides mechanisms to intercept method execution, allowing custom code to run before or after original methods while maintaining the existing program flow. It enables the analysis and rewriting of Common Intermediate Language instructions to change the internal logic of compiled methods. The toolkit also includes utiliti

Xposed is a native Android runtime hooking framework and instrumentation tool. It provides a modified version of the Android app process binary to intercept and modify the behavior of system and application processes at the binary level. The framework enables Android operating system customization by altering internal function calls and runtime execution flow. It achieves this through native process instrumentation, allowing for the modification of functionality without altering original application files. The tool covers several low-level capabilities, including native library injection and

unidbg is a framework for emulating and debugging ARM32 and ARM64 native binaries on a host machine. It serves as an Android and iOS binary debugger and native library emulator, allowing for the execution of native code without the need for physical hardware. The project distinguishes itself through a native function hooking framework and a Model Context Protocol debugging tool that exposes emulator state to AI assistants for automated binary analysis. It also includes a specialized memory analyzer for tracking guest-side allocations and identifying leaks in native binaries. The toolset cove

Dynamic Instrumentation Tool Platform

Piko is a collection of specialized Android utilities designed for binary patching, user interface customization, media downloading, and application debugging. It functions as an APK modification framework that alters application metadata and binary resources to modify internal logic and bypass version locks. The project differentiates itself through deep application modification capabilities, including bytecode-level instruction patching, DEX file manipulation, and a dynamic hooking engine. It enables the overriding of resource files and the injection of permissions via the application manif

Objection is a dynamic instrumentation framework and runtime exploration toolkit for mobile application security analysis. It provides a command-line interface to interact with the memory and state of iOS and Android applications during active execution, serving as a toolkit for runtime analysis and security testing. The project distinguishes itself by providing specialized capabilities to bypass common mobile security controls, including SSL pinning, biometric authentication, and root or jailbreak detection. It enables the extraction of sensitive credentials and data from secure storage syst

REFramework is a runtime modding framework for games built on the RE Engine, providing a C# plugin system with typed proxy code generation, a Lua scripting interface, an ImGui-based UI system, a runtime debugging toolkit, and a VR integration layer. At its core, it intercepts and modifies internal game engine functions and state at runtime through hooking and scripting APIs, enabling deep inspection and manipulation of live game objects. The framework distinguishes itself through typed proxy code generation that auto-creates C# interfaces from the game's type database, giving compile-time saf

Detours is a library for intercepting Win32 API calls and redirecting function calls at runtime on Windows, enabling binary-level instrumentation without requiring access to the original source code. It functions as an API hooking library and binary instrumentation toolkit, allowing developers to monitor or modify the behavior of compiled Windows binaries by hooking into their function execution paths. The project achieves this through detour-based function interception, where the first few instructions of a target function are replaced with a jump to a user-supplied detour function, while pr

BlockTheSpot is a utility designed to modify the behavior of the Spotify desktop application. It functions as an audio stream modifier and media patch, altering the application's runtime execution to remove built-in limitations. The tool specifically targets the suppression of audio and video advertisements during media sessions. It also removes navigation restrictions, allowing users to bypass track skipping limits within the desktop player. These modifications are achieved through dynamic library injection and function hooking, which intercept and redirect execution flow within the applica

This project is an Android security analysis toolkit and mobile app runtime manipulator designed for reverse engineering and auditing mobile applications. It provides a system for modifying Java classes and method behavior in active mobile processes to bypass security controls. The toolkit includes a web-based interface for controlling the instrumentation engine and a specialized utility for disabling certificate validation to intercept and inspect encrypted network traffic via SSL pinning bypass. It also features an Android file explorer for browsing and managing files within private data di