[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-6643":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":10,"language":11,"languages":10,"totalLinesOfCode":10,"stars":12,"forks":13,"watchers":14,"openIssues":15,"contributorsCount":16,"subscribersCount":16,"size":16,"stars1d":17,"stars7d":18,"stars30d":19,"stars90d":16,"forks30d":16,"starsTrendScore":18,"compositeScore":20,"rankGlobal":10,"rankLanguage":10,"license":21,"archived":22,"fork":22,"defaultBranch":23,"hasWiki":24,"hasPages":22,"topics":25,"createdAt":10,"pushedAt":10,"updatedAt":31,"readmeContent":32,"aiSummary":33,"trendingCount":16,"starSnapshotCount":16,"syncStatus":34,"lastSyncTime":35,"discoverSource":36},6643,"xHook","iqiyi\u002FxHook","iqiyi","🔥 A PLT hook library for Android native ELF.","",null,"C",4336,792,112,43,0,1,4,9,65.6,"Other",false,"master",true,[26,27,28,29,30],"android","elf","got","hook","plt","2026-06-12 04:00:29","\u003Cp align=\"center\">\u003Cimg src=\"https:\u002F\u002Fgithub.com\u002Fiqiyi\u002FxHook\u002Fblob\u002Fmaster\u002Fdocs\u002Fxhooklogo.png?raw=true\" alt=\"xhook\" width=\"50%\">\u003C\u002Fp>\n\n# xHook\n\n![](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Flicense-MIT-brightgreen.svg?style=flat)\n![](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FPRs-welcome-brightgreen.svg?style=flat)\n![](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Frelease-1.2.0-red.svg?style=flat)\n![](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FAndroid-4.0%20--%2010-blue.svg?style=flat)\n![](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Farch-armeabi%20%7C%20armeabi--v7a%20%7C%20arm64--v8a%20%7C%20x86%20%7C%20x86__64-blue.svg?style=flat)\n\n[README 中文版](README.zh-CN.md)\n\n[Android PLT hook 概述 中文版](docs\u002Foverview\u002Fandroid_plt_hook_overview.zh-CN.md)\n\nxHook is a PLT (Procedure Linkage Table) hook library for Android native ELF (executable and shared libraries).\n\nxHook has been keeping optimized for stability and compatibility.\n\n\n## Features\n\n* Support Android 4.0 - 10 (API level 14 - 29).\n* Support armeabi, armeabi-v7a, arm64-v8a, x86 and x86_64.\n* Support **ELF HASH** and **GNU HASH** indexed symbols.\n* Support **SLEB128** encoded relocation info.\n* Support setting hook info via regular expressions.\n* Do not require root permission or any system permissions.\n* Do not depends on any third-party shared libraries.\n\n\n## Build\n\n* Download [Android NDK r16b](https:\u002F\u002Fdeveloper.android.com\u002Fndk\u002Fdownloads\u002Frevision_history.html), set environment PATH. (support for armeabi has been removed since r17)\n\n* Build and install the native libraries.\n\n```\n.\u002Fbuild_libs.sh\n.\u002Finstall_libs.sh\n```\n\n\n## Demo\n\n```\ncd .\u002Fxhookwrapper\u002F\n.\u002Fgradlew assembleDebug\nadb install .\u002Fapp\u002Fbuild\u002Foutputs\u002Fapk\u002Fdebug\u002Fapp-debug.apk\n```\n\n\n## API\n\nExternal API header file: `libxhook\u002Fjni\u002Fxhook.h`\n\n### 1. Register hook info\n\n```c\nint xhook_register(const char  *pathname_regex_str,  \n                   const char  *symbol,  \n                   void        *new_func,  \n                   void       **old_func);\n```\n\nIn current process's memory space, in every loaded ELF which pathname matches regular expression `pathname_regex_str`, every PLT entries to `symbol` will be **replaced with** `new_func`. The original one will be saved in `old_func`.\n\nThe `new_func` **must** have the same function declaration as the original one.\n\nReturn zero if successful, non-zero otherwise.\n\nThe regular expression for `pathname_regex_str` only support **POSIX BRE (Basic Regular Expression)**.\n\n### 2. Ignore some hook info\n\n```c\nint xhook_ignore(const char *pathname_regex_str,  \n                 const char *symbol);\n```\n\nIgnore some hook info according to `pathname_regex_str` and `symbol`, from registered hooks by `xhook_register`. If `symbol` is `NULL`, xhook will ignore all symbols from ELF which pathname matches `pathname_regex_str`.\n\nReturn zero if successful, non-zero otherwise.\n\nThe regular expression for `pathname_regex_str` only support **POSIX BRE**.\n\n### 3. Do hook\n\n```c\nint xhook_refresh(int async);\n```\n\nDo the real hook operations according to the registered hook info.\n\nPass `1` to `async` for asynchronous hook. Pass `0` to `async` for synchronous hook.\n\nReturn zero if successful, non-zero otherwise.\n\nxhook will keep a global cache for saving the last ELF loading info from `\u002Fproc\u002Fself\u002Fmaps`. This cache will also be updated in `xhook_refresh`. With this cache, `xhook_refresh` can determine which ELF is newly loaded. We only need to do hook in these newly loaded ELF.\n\n### 4. Clear cache\n\n```c\nvoid xhook_clear();\n```\n\nClear all cache owned by xhook, reset all global flags to default value.\n\nIf you confirm that all PLT entries you want have been hooked, you could call this function to save some memory.\n\n### 5. Enable\u002FDisable debug info\n\n```c\nvoid xhook_enable_debug(int flag);\n```\n\nPass `1` to `flag` for enable debug info. Pass `0` to `flag` for disable. (**disabled** by default)\n\nDebug info will be sent to logcat with tag `xhook`.\n\n### 6. Enable\u002FDisable SFP (segmentation fault protection)\n\n```c\nvoid xhook_enable_sigsegv_protection(int flag);\n```\n\nPass `1` to `flag` for enable SFP. Pass `0` to `flag` for disable. (**enabled** by default) \n\nxhook is NOT a compliant business layer library. We have to calculate the value of some pointers directly. Reading or writing the memory pointed to by these pointers will cause a segmentation fault in some unusual situations and environment. The APP crash rate increased which caused by xhook is about one ten-millionth (0.0000001) according to our test. (The increased crash rate is also related to the ELFs and symbols you need to hook). Finally, we have to use some trick to prevent this harmless crashing. We called it SFP (segmentation fault protection) which consists of: `sigaction()`, `SIGSEGV`, `siglongjmp()` and `sigsetjmp()`.\n\n**You should always enable SFP for release-APP, this will prevent your app from crashing. On the other hand, you should always disable SFP for debug-APP, so you can't miss any common coding mistakes that should be fixed.**\n\n\n## Examples\n\n```c\n\u002F\u002Fdetect memory leaks\nxhook_register(\".*\\\\.so$\", \"malloc\",  my_malloc,  NULL);\nxhook_register(\".*\\\\.so$\", \"calloc\",  my_calloc,  NULL);\nxhook_register(\".*\\\\.so$\", \"realloc\", my_realloc, NULL);\nxhook_register(\".*\\\\.so$\", \"free\",    my_free,    NULL);\n\n\u002F\u002Finspect sockets lifecycle\nxhook_register(\".*\\\\.so$\", \"getaddrinfo\", my_getaddrinfo, NULL);\nxhook_register(\".*\\\\.so$\", \"socket\",      my_socket,      NULL);\nxhook_register(\".*\\\\.so$\", \"setsockopt\"   my_setsockopt,  NULL);\nxhook_register(\".*\\\\.so$\", \"bind\",        my_bind,        NULL);\nxhook_register(\".*\\\\.so$\", \"listen\",      my_listen,      NULL);\nxhook_register(\".*\\\\.so$\", \"connect\",     my_connect,     NULL);\nxhook_register(\".*\\\\.so$\", \"shutdown\",    my_shutdown,    NULL);\nxhook_register(\".*\\\\.so$\", \"close\",       my_close,       NULL);\n\n\u002F\u002Ffilter off and save some android log to local file\nxhook_register(\".*\\\\.so$\", \"__android_log_write\",  my_log_write,  NULL);\nxhook_register(\".*\\\\.so$\", \"__android_log_print\",  my_log_print,  NULL);\nxhook_register(\".*\\\\.so$\", \"__android_log_vprint\", my_log_vprint, NULL);\nxhook_register(\".*\\\\.so$\", \"__android_log_assert\", my_log_assert, NULL);\n\n\u002F\u002Ftracking (ignore linker and linker64)\nxhook_register(\"^\u002Fsystem\u002F.*$\", \"mmap\",   my_mmap,   NULL);\nxhook_register(\"^\u002Fvendor\u002F.*$\", \"munmap\", my_munmap, NULL);\nxhook_ignore  (\".*\u002Flinker$\",   \"mmap\");\nxhook_ignore  (\".*\u002Flinker$\",   \"munmap\");\nxhook_ignore  (\".*\u002Flinker64$\", \"mmap\");\nxhook_ignore  (\".*\u002Flinker64$\", \"munmap\");\n\n\u002F\u002Fdefense to some injection attacks\nxhook_register(\".*com\\\\.hacker.*\\\\.so$\", \"malloc\",  my_malloc_always_return_NULL, NULL);\nxhook_register(\".*\u002Flibhacker\\\\.so$\",     \"connect\", my_connect_with_recorder,     NULL);\n\n\u002F\u002Ffix some system bug\nxhook_register(\".*some_vendor.*\u002Flibvictim\\\\.so$\", \"bad_func\", my_nice_func, NULL);\n\n\u002F\u002Fignore all hooks in libwebviewchromium.so\nxhook_ignore(\".*\u002Flibwebviewchromium.so$\", NULL);\n\n\u002F\u002Fhook now!\nxhook_refresh(1);\n```\n\n\n## Support\n\n* [GitHub Issues](https:\u002F\u002Fgithub.com\u002Fiqiyi\u002FxHook\u002Fissues)\n* [GitHub Discussions](https:\u002F\u002Fgithub.com\u002Fiqiyi\u002FxHook\u002Fdiscussions)\n\n\n## Contributing\n\nSee [xHook Contributing Guide](CONTRIBUTING.md).\n\n\n## License\n\nxHook is MIT licensed, as found in the [LICENSE](LICENSE) file.\n\nxHook documentation is Creative Commons licensed, as found in the [LICENSE-docs](LICENSE-docs) file.\n","xHook 是一个针对 Android 原生 ELF 文件的 PLT（过程链接表）钩子库。它支持对 Android 4.0 至 10 版本中使用的各种架构（包括 armeabi, armeabi-v7a, arm64-v8a, x86 和 x86_64）进行函数替换，同时兼容 ELF HASH 和 GNU HASH 索引符号以及 SLEB128 编码重定位信息。该库允许通过正则表达式设置钩子信息，并且无需 root 权限或任何系统权限即可工作。xHook 适用于需要在不修改源代码的情况下动态修改应用程序行为的场景，如调试、性能分析或安全研究等。",2,"2026-06-11 03:08:02","top_language"]