HoShiMin/HookLib
FreeThe functions interception library written on pure C and NativeAPI with UserMode and KernelMode support
FreeFree tier
About HoShiMin/HookLib
HookLib is a lightweight, pure C functions interception library for Win32 that leverages the Zydis disassembler and NativeAPI functions. It supports both user-mode and kernel-mode hooking with minimal overhead. The library enables instruction relocation, thread context fixup, and multi-hook sessions. It features an extremely small memory footprint (one 4KB page can hold 39 hooks) and offers kernel-mode to user-mode hooking across different architectures (x64, x86, Wow64).
Key Features
Written in pure C with no external dependencies
Based on the fastest and lightweight Zydis disassembler
Uses only NativeAPI functions
Kernel-mode support for intercepting kernel-space functions
Supports instruction relocation and thread context fixup
Multi-hook and multi-unhook support in a single session
Extremely low memory consumption: one 4KB page holds up to 39 hooks
Supports KM-UM hooks across architectures (Amd64, Wow64, i386)
C++ helper utilities for easier hook installation (HookFactory)
Pros & Cons
Pros
- Extremely lightweight with minimal overhead
- No external dependencies beyond what Windows provides
- Supports both user-mode and kernel-mode hooking
- Efficient memory usage with shared hook pages
- Cross-architecture KM-UM hooking support
- Active open-source project with public repository
Cons
- Windows-only (Win32) library, not cross-platform
- Requires deep understanding of C/C++ and Windows internals to use effectively
- Documentation limited to the README and code examples
- Not suitable for application-level development without low-level knowledge
Best For
API hooking for debugging and reverse engineeringPerformance monitoring and profiling of Windows applicationsImplementing security sandboxes or behavior analysis toolsGame modding and function interception for customizationKernel-mode driver development for system call monitoring
FAQ
What is HookLib?
HookLib is a lightweight functions interception library for Windows written in pure C. It uses the Zydis disassembler and NativeAPI functions to hook function calls in both user-mode and kernel-mode.
How does HookLib work?
HookLib overwrites the target function's beginning with a jump to a handler, then preserves the original bytes in a trampoline. It supports relative and absolute jumps, and can fix up thread contexts for seamless execution.
What is the difference between HookLib Gen 1 and Gen 2?
Gen 2 is a complete rewrite that reduces memory consumption, eliminates excessive allocations and handle manipulations, adds multi-hook/multi-unhook support, and introduces cross-architecture KM-UM hooking.
Does HookLib have any dependencies?
No, HookLib has no external dependencies. It only uses NativeAPI functions and the Zydis disassembler (which is embedded).