We are comparing our hooking engine Deviare with some of the other products available, so that you can get an idea of what each engine can provide.
Here is a comparison of Deviare against Easy Hook.
Functionality | Deviare | EasyHook |
---|---|---|
Database with Functions and Data Types | Yes | No |
Intercept multiple functions with a single handler | Yes | No |
Selective Handler for each Function | Yes | Yes |
Relocation of Relative ASM Instructions (RIP) | Yes | No |
Save & access Call Function Context | Yes | No |
Access registers & flags | Yes | No |
Access return address | Yes | Yes |
Get/Set win32 last error | Yes | Yes |
Monitor COM Objects creations | Yes | Partially |
Hook COM Objects | Yes | No |
Provides COM Interfaces accessible from any language | Yes | No |
Enumerate process’ modules | Yes | Yes |
Enumerate module’s exported functions | Yes | No |
Get module path and info | Yes | Yes |
Automated call of original function | Yes | No |
Thread Deadlock Block | Yes | Yes |
64 bits support | No | Yes |
Thread Safe Hook Install | Yes | No |
Native Support | Yes | Partially |
Inter-Process Communication | Yes | Partially |
Custom Library Injection | Yes | Yes |
Stealth Support | No | Yes |
Kernel Mode Hook | No | Yes |
Driver Installation | No | Yes |
Relocation of Instruction Pointer | Yes | No |
Requires .Net Framework | No | Yes |
Use System Runtimes (CRT) | Yes | No |
Hook Terminal Sessions | No | Yes |
Full unload before target termination. | Yes | No |
Execute As Service | No | Yes |
Prevent execution inside OS Loader | No | Yes |
Thread selection filter | No | Yes |
StackTrace | Yes | Yes |
User-mode Wide Hook | Yes | No |
I believed to know about hooking code until reading this functionality table. Where can I learn more about each of the listed features?