If you don't know which hook you should use, this page is for you.
Quick hooks description
Monitoring hook : Just log function calls.Parameters can be logged before or after function call according to the In or Out keywords (see monitoring file syntax direction). If you need sometimes to change parameters values or return, you can add a breaking option on hook definition.
Monitoring hooks are defined in monitoring files
Monitoring is affected by monitoring filters (logs are kept or trashed according to calling dll).
Overriding hook : a single function that will be called instead of the original one. Notice : you can call original function inside your new code, but it's not an obligation.
Overriding hooks are defined in overriding dll
Overriding is affected by overriding filters (original API or your code replacement is called according to calling dll).
Pre hook : one or more functions executed before calling original function. It allow to log or change parameters automatically at each call.
Pre hooks are defined in overriding dll
Not affected by overriding filters (you will get the filtering result as parameter, so you are free to use filtering or not)
Post hook : one or more functions executed after calling original function. It allow to change function return, log or change parameters automatically at each call
Post hooks are defined in overriding dll
Not affected by overriding filters (you will get the filtering result as parameter, so you are free to use filtering or not)
 |
All these hooks can be mixed together, that means a single API can have a monitoring hook, and pre hook(s), and an overriding hook, and post hook(s). |
Hooking Sequence
