Mhook

In this article, I am going to share with you the 10 best Mhook alternatives in 2024 that you can use.

• Mhook description and review
• Best list of Mhook Alternatives
• Mhook: pros and cons
• Mhook: Price
• Benefits
• FAQ

Mhook description and review

If you dabble in this area, then you already know that Microsoft Research’s Detours pretty much sets the benchmark when it comes to API binding. So why don’t we get a comparison out of the way quickly?

DEVICES VS. MHOOK

Detours is available for free with a non-commercial license, but it is only supported on the x86 platform. Detours can also get a license for commercial use, which also gives you full x64 support, but you can only view the license conditions after signing an NDA.

Mhook is freely distributed under an MIT license with support for x86 and x64.

Detours avoids officially supporting hooking up to a running application. Of course, you are free to do so, but if you end up causing a random crash here or there, you can only blame yourself.

Mhook was meant to be able to set and remove hooks in running applications; after all, that’s what you need it for in the real world. It does its best to avoid overwriting code that might be running by another thread.

Detours supports transactional latching and unhooking; that is, setting a bunch of hooks at the same time with an all or nothing approach. Hooks will only be set if all can be set, otherwise the library will revert any changes made. Mhook does not do this.

Finally, Mhook is pretty lazy when it comes to managing the memory of the trampolines it uses. Detours allocates memory blocks as needed and uses the resulting data area to store as many springboards as will fit. Mhook, on the other hand, uses a call to VirtualAlloc for every hook that is set. Each hook needs less than 100 bytes of storage, so this is a waste as VirtualAlloc ends up taking 64K of the process’s virtual address space every time Mhook calls it. (The actual allocated memory will be a single page, which is also a waste.) In the end though, this probably doesn’t matter, unless you’re setting up a large number of bindings in an app. Also, this is very easy to fix.

Mhook is a library for installing API bindings.

Developed by Márton Anka

Mhook is freely distributed under an MIT license with support for x86 and x64.

Detours avoids officially supporting hooking up to a running application. Of course, you are free to do so, but if you end up causing a random crash here or there, you can only blame yourself.

Mhook was meant to be able to set and remove hooks in running applications; after all, that’s what you need it for in the real world. It does its best to avoid overwriting code that might be running by another thread.

Detours supports transactional latching and unhooking; that is, setting a bunch of hooks at the same time with an all or nothing approach. Hooks will only be set if all can be set, otherwise the library will revert any changes made. Mhook does not do this.

Finally, Mhook is pretty lazy when it comes to managing the memory of the trampolines it uses. Detours allocates memory blocks as needed and uses the resulting data area to store as many springboards as will fit. Mhook, on the other hand, uses a call to VirtualAlloc for every hook that is set. Each hook needs less than 100 bytes of storage, so this is a waste as VirtualAlloc ends up taking 64K of the process’s virtual address space every time Mhook calls it. (The actual allocated memory will be a single page, which is also a waste.) In the end though, this probably doesn’t matter, unless you’re setting up a large number of bindings in an app. Also, this is very easy to fix.

Link to the official Mhook site

Official website

Best list of Mhook Alternatives

Microsoft research detours

Microsoft Research Detours v3 Professional is a library for instrumenting arbitrary Win32 functions on x86, x64, and IA64 machines. Now you can intercept Win32 functions …

I will deviate in process

Deviare In-Process is a code interception engine for Microsoft Windows®. It is a dual license library, GPLv3 and Commercial. The source code is available on GitHub.

HookInjEx

Demo application that demonstrates how to inject code into the address space of other processes and then run it in the context of this process.

WinAPIOverride

This software allows you to monitor and / or modify any function of a process for any calling convention (stdcall or cdecl).

Want to see more alternatives for Mhook?

Mhook: pros and cons

Mhook: Price

The software of Mhook gives you easy and efficient management, and Mhook allows you to concentrate on the most important things. And it’s easy to use; you may love it.

Benefits

FAQ