Shameless plug but my company is almost wholly oriented to binary intrumentation!

In our Deviare Hooking Engine/Deviare In Process [gihub-1] and RemoteBridge [github-2], we have a disassembler in place to hook Win32/COM/C++ vtables, so the hooking process is smarter if there are changes in the prologue. You can obviously take a look at the source code and learn a lot from it since it is state of art and perfectly competing with Microsoft Detours [3]. For an old comparison with Microsoft Detours you can check [4].

For anyone else looking for an extremely easy to use and higher level API, Deviare Hooking Engine makes extremely easy to hook and handle functions parameters and return value. Simple like this:

[snippet]

            notepadPID = LaunchNotepadAndGetPid();

            //in first place, hook DllGetClassObject of the target dll/ocx
            hookDllGetClassObj = spyMgr.CreateHook("shell32.dll!DllGetClassObject", (int)eNktHookFlags.flgOnlyPostCall);
            hookDllGetClassObj.Attach(notepadPID, true);
            hookDllGetClassObj.Hook(true);
            hookDllGetClassObj.OnFunctionCalled += OnDllGetClassObjectCalled;

[/snippet]

Docs are available here: http://www.nektra.com/products/deviare-api-hook-windows/doc-...

[github-1] https://github.com/nektra/Deviare2

[github-1 bis] https://github.com/nektra/Deviare-InProc

[github-2] https://github.com/nektra/RemoteBridge

[3] http://research.microsoft.com/en-us/projects/detours/

[4] https://www.reddit.com/r/programming/comments/22crn0/gpl_alt...