dynhook.h

/*!
    DynHook, x86 Dynamic Relocation Hooking Library for Unix &
    Unix-Like Operating Systems. Open-Source & Public Domain.

    2026 ubelstahl.
*/

#ifndef _GNU_SOURCE
#define _GNU_SOURCE
#endif

#ifndef __H_DYNHOOK
#define __H_DYNHOOK

#include <link.h>
#include <dlfcn.h>
#include <errno.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/mman.h>
#include <stdbool.h>

#ifdef DEBUG
#define debug( format, ... ) printf( "DEBUG: " format "\n", ##__VA_ARGS__ )
#else
#define debug( ... )
#endif

#define PROT_RW ( PROT_READ | PROT_WRITE )
#define PROT_RX ( PROT_READ | PROT_EXEC  )

typedef struct {
    uintptr_t addr;
    int origOffset;
} CallInst;

typedef struct DynHook {
    CallInst *patches;
    size_t patchCount;
    void *original;
} *DynHook_t;

#if __x86_64__ || __ppc64__ || __amd64__
	#define Elf_Addr   Elf64_Addr
	#define Elf_Dyn    Elf64_Dyn
	#define Elf_Sym    Elf64_Sym
	#define Elf_Rel    Elf64_Rel
	#define Elf_Rela   Elf64_Rela
	#define ELF_R_SYM  ELF64_R_SYM
	#define ELF_R_TYPE ELF64_R_TYPE
#elif _M_IX86 || __i386__
    #define Elf_Addr   Elf32_Addr
	#define Elf_Dyn    Elf32_Dyn
	#define Elf_Sym    Elf32_Sym
	#define Elf_Rel    Elf32_Rel
	#define Elf_Rela   Elf32_Rela
	#define ELF_R_SYM  ELF32_R_SYM
	#define ELF_R_TYPE ELF32_R_TYPE
#else
	#error Unsupported bits/architecture.
#endif

static inline void DynHook_free ( DynHook_t hook ) {
    if ( !hook )
        return;
    if ( hook->patchCount > 0 ) {
        uint32_t pageSize = getpagesize();

        for ( size_t i = 0; i < hook->patchCount; i++ ) {
            // We have to calculate the relative address
            CallInst current = hook->patches[ i ];
            void *pageStart = ( void* )( current.addr & ~( pageSize - 1 ) );

            if ( mprotect( pageStart, pageSize, PROT_RW ) != 0 ) {
                debug( "mprotect failed at address %p: %s",
                    pageStart, strerror( errno ) );
                continue;
            }

			debug( "Ejecting %p at address %p",
                current.origOffset, current.addr );

            __atomic_store_n( ( int* )current.addr,
                current.origOffset, __ATOMIC_RELEASE );
            __builtin_ia32_mfence();

            // Restore the page permissions
            mprotect( pageStart, pageSize, PROT_RX );
        }
    }
    if ( hook->patches )
        free( hook->patches );
    free( hook );
}

#define DynHook_GetOriginal( hook, type ) \
    ( ( type )( ( hook )->original ) )

#ifdef __cplusplus
template <typename T> static T DynHook_original ( DynHook_t hook ) {
    return DynHook_GetOriginal( hook, T );
}
#endif

static inline DynHook_t DynHook_new ( void *handle, const char *targetSymbol,
    void *hookFunc ) {
    struct link_map* map;

    // Get the link map from the handle
    if ( dlinfo( handle, 2, &map ) != 0 ) {
        debug( "dlinfo failed: %s", dlerror() );
        return NULL;
    }

    Elf_Addr loadAddr = ( Elf_Addr )map->l_addr;
    Elf_Dyn* dynamic  = ( Elf_Dyn* )map->l_ld;

    const char* strtab     = NULL;
    Elf_Sym*    symtab     = NULL;
    void*       relaDyn     = NULL;
    size_t      relaDynSize = 0;
    bool        implicit   = false;

    uint32_t pageSize = getpagesize();

    // Find DT_STRTAB, DT_SYMTAB, DT_REL and DT_RELSZ
    for ( ; dynamic->d_tag != DT_NULL; ++dynamic ) {
        switch ( dynamic->d_tag ) {
            case DT_STRTAB:
                strtab = ( const char* )( dynamic->d_un.d_ptr );
                break;
            case DT_SYMTAB:
                symtab = ( Elf_Sym* )( dynamic->d_un.d_ptr );
                break;
            case DT_REL:
                relaDyn = ( void* )( dynamic->d_un.d_ptr );
                implicit = true;
                break;
            case DT_RELSZ:
                relaDynSize = dynamic->d_un.d_val;
                break;
            case DT_RELA:
                relaDyn = ( void* )( dynamic->d_un.d_ptr );
                implicit = false;
                break;
            case DT_RELASZ:
                relaDynSize = dynamic->d_un.d_val;
                break;
        }
    }

    int relaSizeS = implicit ? sizeof( Elf_Rel ) : sizeof( Elf_Rela );
    int dynCount  = relaDynSize / relaSizeS;

    // Now we're going to search for the symbol.
    // When we find the first result, we're gonna store it
    // as original and hook the other ones.
    DynHook_t result = ( DynHook_t )malloc( sizeof( struct DynHook ) );
    result->patchCount = 0;
    result->patches = NULL;
    result->original = NULL;

    for ( int i = 0; i < dynCount; ++i ) {
        uintptr_t entryPtr = ( uintptr_t )relaDyn + ( i * relaSizeS );
        Elf_Rel* rel = ( Elf_Rel* )entryPtr;

        int idx  = ELF_R_SYM ( rel->r_info );
        int type = ELF_R_TYPE( rel->r_info );

        if ( idx == 0 )
            continue;

        // Get the current symbol name
        const char* name = strtab + symtab[ idx ].st_name;

        // Type 2 is R_386_PC32 btw.
        if ( !name || type != 2 || strcmp( targetSymbol, name ) != 0 )
            continue;

        // We found an entry. Resolve the target address and store it
        uintptr_t entryAddr = ( uintptr_t )( loadAddr + rel->r_offset );

        int callOffset;
        memcpy( &callOffset, ( void* )entryAddr, 4 );

        debug( "Found entry of %s at address %p points to address %p",
            name, entryAddr, callOffset );

        // If this is our first entry, resolve the original
        if ( result->original == NULL )
            result->original = ( void* )( callOffset + ( entryAddr + 4 ) );

        // Get the residing page of the memory location we're going
        // to patch. We don't want memory issues here.
        void *pageStart = ( void* )( entryAddr & ~( pageSize - 1 ) );

        if ( mprotect( pageStart, pageSize, PROT_RW ) != 0 ) {
            debug( "mprotect failed at address %p: %s",
                pageStart, strerror( errno ) );
            continue;
        }

        // Now that it's safe to modify, we can store the details
        result->patches = ( CallInst* )realloc( result->patches,
            sizeof( CallInst ) * ( result->patchCount + 1 ) );
        result->patches[ result->patchCount ] =
            ( CallInst ){ entryAddr, callOffset };
        result->patchCount++;

        // Calculate the new offset
        int newOffset = ( int )( ( uintptr_t )hookFunc - ( entryAddr + 4 ) );

        // Patch the instruction using atomic operations to make sure
        // the write operation happens in one instruction. After that,
        // synchronize the CPU cache.
        __atomic_store_n( ( int* )entryAddr, newOffset, __ATOMIC_RELEASE );
        __builtin_ia32_mfence();

        // Restore the page permissions
        mprotect( pageStart, pageSize, PROT_RX );
    }

    if ( result->patchCount == 0 ) {
        DynHook_free( result );
        return NULL;
    }

    return result;
}

// And here's some "useless" macros

#define DynHook_DefHook( ret, func, ... ) \
    typedef ret ( *func##_tDynHook )( __VA_ARGS__ ); \
    static func##_tDynHook __DynHook_OriginalRef_##func = NULL; \
    static DynHook_t __DynHook_HookStore_##func; \
    ret __DynHook_HookRef_##func ( __VA_ARGS__ )

#define DynHook_Start( handle, sym, func ) \
    __DynHook_HookStore_##func = DynHook_new( handle, sym, \
        ( void* )__DynHook_HookRef_##func ); \
    if ( __DynHook_HookStore_##func ) \
        __DynHook_OriginalRef_##func = DynHook_GetOriginal \
            ( __DynHook_HookStore_##func, func##_tDynHook );

#define DynHook_Stop( func ) \
    DynHook_free( __DynHook_HookStore_##func )

#define DynHook_Super( func, ... ) \
    __DynHook_OriginalRef_##func( __VA_ARGS__ )

#endif