Download
shadowhook is an open-source native code hooking library for Android — designed to let developers intercept and override native (C/C++) functions inside Android apps at runtime. It supports both ARM32 and ARM64 architectures (and the respective “thumb” instruction set) and works across a wide range of Android OS versions. The library allows you to specify hook targets either by function address or by library name + function name, and it automatically handles newly loaded shared libraries (ELFs), ensuring hooks remain effective even when code is dynamically loaded at runtime. ShadowHook strives to be stable and safe for production use: it automatically avoids circular-call recursion between original and proxy functions, and supports unwind/unwind-safe proxy functions (CFI/FP unwind) so that backtraces, debugging, and stack unwinding remain correct. It also offers optional intercept and logging capabilities, letting developers record hooked calls.
Features
- Support for ARM32 and ARM64, including “thumb” instruction mode, enabling hooking on broad Android devices
- Function hooking by address or by “library name + symbol name,” giving flexibility in how hooks are specified
- Automatic hooking of newly loaded shared libraries (ELFs), ensuring dynamic libs are also intercepted
- Prevention of recursive or circular calls between proxy and original functions to avoid infinite loops or crashes
- Prevention of recursive or circular calls between proxy and original functions to avoid infinite loops or crashes
- MIT-licensed and stable enough for production use (used internally by large apps), enabling embedding or integration into other tools
Project Samples
