Skip to content
This repository was archived by the owner on Oct 23, 2025. It is now read-only.

Commit 6a241dc

Browse files
committed
Update README.md
1 parent 0404b37 commit 6a241dc

File tree

1 file changed

+132
-1
lines changed

1 file changed

+132
-1
lines changed

README.md

Lines changed: 132 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,133 @@
11
# TrampHook
2-
A trampoline hook library
2+
3+
A lightweight trampoline hook library for x86 and x64 Windows applications. TrampHook allows you to intercept function calls while preserving the ability to call the original function.
4+
5+
## Features
6+
7+
- Supports both x86 and x64 architectures
8+
- Preserves original function calls through trampolines
9+
- Minimal overhead
10+
11+
## Installation
12+
13+
1. Clone the repository:
14+
```bash
15+
git clone https://github.com/yourusername/TrampHook.git
16+
```
17+
18+
2. Add the include directory to your project
19+
3. Link against the library
20+
21+
## Usage
22+
23+
### Basic Example
24+
25+
```cpp
26+
#include <TrampHook/TrampHook.h>
27+
28+
// Function to be hooked
29+
typedef int (*OriginalFunc)(int a, int b);
30+
31+
// Our detour function
32+
int DetourFunction(int a, int b)
33+
{
34+
// Do something before the original call
35+
printf("Before original call: %d, %d\n", a, b);
36+
37+
// Call original function through the trampoline
38+
OriginalFunc original = (OriginalFunc)TrampHook::hook(originalFunction, DetourFunction);
39+
int result = original(a, b);
40+
41+
// Do something after the original call
42+
printf("After original call. Result: %d\n", result);
43+
return result;
44+
}
45+
46+
int main()
47+
{
48+
// Hook the function
49+
void* trampoline = TrampHook::hook(originalFunction, DetourFunction);
50+
51+
if (!trampoline)
52+
{
53+
printf("Failed to hook function\n");
54+
return 1;
55+
}
56+
57+
// Call the function (will go through our detour)
58+
originalFunction(5, 3);
59+
60+
// Unhook when done
61+
TrampHook::unhook(originalFunction);
62+
return 0;
63+
}
64+
```
65+
66+
### API Reference
67+
68+
```cpp
69+
namespace TrampHook
70+
{
71+
public:
72+
// Hook a function, returns trampoline pointer or nullptr on failure
73+
void* hook(void* target, void* detour);
74+
75+
// Remove hook from a specific function
76+
void unhook(void* target);
77+
78+
// Remove all hooks
79+
void unhookAll();
80+
};
81+
```
82+
83+
## How It Works
84+
85+
TrampHook uses a trampoline-based hooking approach:
86+
87+
1. **Analysis**: Disassembles enough instructions from the target function to make room for the hook
88+
2. **Trampoline**: Copies the original instructions to a new executable memory location
89+
3. **Jump Back**: Adds a jump from the trampoline back to the original function
90+
4. **Hook Placement**: Places a jump to the detour function at the original location
91+
92+
```
93+
Original Function: Trampoline:
94+
┌─────────────────────────────┐ ┌─────────────────────────────┐
95+
│ injected jump to detour │ │ overwritten instruction1 │
96+
│ dummy code for alignement │──┐ │ overwritten instruction2 │
97+
│ original instructions │ │ │ ... │
98+
│ ... │◄─│──────│ jump back │
99+
└─────────────────────────────┘ │ └─────────────────────────────┘
100+
│ ▲
101+
│ │
102+
Detour Function: │ │
103+
┌─────────────────────────────┐ │ │
104+
│ pre-processing │◄─┘ │
105+
│ call trampoline │───────────┘
106+
│ post-processing │
107+
└─────────────────────────────┘
108+
```
109+
110+
## Platform Support
111+
112+
- Windows x86 (32-bit)
113+
- Windows x64 (64-bit)
114+
115+
## Limitations
116+
117+
- Requires at least 5 bytes (x86) or 12 bytes (x64) for hooking
118+
- Some functions may not be hookable due to their instruction patterns (the library does not handle/resolve relative jumps in the trampoline)
119+
- Does not handle thread-safety
120+
121+
## Contributing
122+
123+
Contributions are welcome! Please feel free to submit a Pull Request.
124+
125+
## License
126+
127+
This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.
128+
129+
## Security Considerations
130+
131+
- Ensure you have the necessary permissions to modify code memory
132+
- Be aware that antivirus and anti-cheat software may flag hooking behavior
133+
- Consider thread safety

0 commit comments

Comments
 (0)