jmpews/Dobby
Dobby
Dobby is a dynamic function hooking framework and binary instrumentation tool designed to intercept and redirect function calls in compiled binaries. It serves as a cross-platform and cross-architecture library that provides a unified interface for modifying program execution flow across different operating systems and CPU architectures.
The library enables low-level binary instrumentation and runtime application instrumentation by injecting custom handlers into live processes. It is used for software reverse engineering to observe real-time data flow and logic by hooking internal functions.
The framework covers binary patching, runtime symbol resolution, and the generation of dynamic trampolines. It manages platform-specific memory protections and maps generic hook requests into architecture-specific opcodes to redirect execution via instruction-based hooking.
Features
- Function Hooking - Provides a framework for intercepting and redirecting function calls in running programs to modify behavior.
- Cross-Platform Function Interception - Redirects execution from target functions to custom handlers across various operating systems and CPU architectures.
- Trampoline-Based Hook Engines - Implements a hooking engine that uses dynamic trampolines to redirect execution to custom handlers.
- Instruction Hooking - Redirects program execution flow by modifying function entry points at the instruction level.
- Cross-Architecture Hooking Libraries - Provides a unified interface for function redirection across various hardware platforms.
- Cross-Platform Hooking Libraries - Translates generic hook requests into machine-specific opcodes for multiple hardware architectures and platforms.
- Binary Instrumentation - Implements binary instrumentation by injecting diagnostic or monitoring code into compiled binaries.
- Binary Instrumentation Tools - Provides a toolset for modifying program execution flow by injecting custom handlers into live processes.
- Dynamic Function Interception - Implements a low-level framework for intercepting and redirecting function calls in compiled binaries.
- Architecture-Specific Mappings - Provides a mechanism to translate generic hook requests into architecture-specific machine code sequences.
- Reverse Engineering Tools - Enables analysis of compiled program logic and data flow by hooking internal functions in real time.
- Cross-Platform Binary Modifications - Applies custom logic and patches to compiled binaries across different operating systems and architectures.
- Relocatable Code Injections - Injects custom logic into process memory while maintaining correct relative addresses for execution.
- Memory Protection Managers - Modifies memory protection flags at runtime to allow writing to executable code segments.
- Process-Level Instrumentation - Injects custom handlers into live processes to monitor internal function calls or alter execution flow.
- Runtime Symbol Resolution - Resolves function entry points in compiled binaries by parsing symbol tables or scanning for byte signatures at runtime.
- Android Hooking Frameworks - Lightweight multi-platform hook framework for native code.
Star history
How this analysis was created: This summary and feature list were written by an AI model that read the project's README and public documentation pages. Each feature links to the documentation it came from; stars, license and language come straight from the GitHub API. The model does not read the source code, and the analysis is refreshed when the project is re-analysed. Learn more on our About page.
