tsudakageyu/minhook

MinHook is a small C library for Windows that lets developers intercept and modify the behavior of existing functions in a running program. The technique is called API hooking: you point MinHook at a function in memory, and it rewrites the start of that function with a jump to your own code. When the original function gets called, your code runs first (or instead), and you can then optionally call through to the original. This is commonly used for debugging, profiling, modifying the behavior of third-party software without access to its source code, and security research. The library targets both 32-bit (x86) and 64-bit (x64) Windows processes. The library's API is intentionally small. The main functions let you create a hook, enable or disable it, and remove it. There are helper functions for hooking functions that you locate by name inside a DLL, which is more convenient than finding the raw memory address yourself. When you need to enable or disable many hooks at once, a queue-and-apply pattern is available so that threads are only suspended once for the whole batch rather than once per hook. MinHook is written in plain C and has no external dependencies. The codebase was rewritten from C++ to C in version 1.3 specifically to reduce the binary size. The library can be built with Visual Studio, Clang, and MinGW, and CMake support was added in version 1.3.4. It is also available as a package through vcpkg, Microsoft's C++ package manager. The project has been maintained since 2009 and is released under the 2-clause BSD license. Full documentation and background are on the project's CodeProject page.