We are comparing our hooking engine Deviare with some of the other products available, so that you can get an idea of what each engine can provide.
Here is a comparison of Deviare against Easy Hook.
| Functionality | Deviare | EasyHook |
|---|---|---|
| Database with Functions and Data Types | Yes |
No |
| Intercept multiple functions with a single handler | Yes |
No |
| Selective Handler for each Function | Yes |
Yes |
| Relocation of Relative ASM Instructions (RIP) | Yes |
No |
| Save & access Call Function Context | Yes |
No |
| Access registers & flags | Yes |
No |
| Access return address | Yes |
Yes |
| Get/Set win32 last error | Yes |
Yes |
| Monitor COM Objects creations | Yes |
Partially |
| Hook COM Objects | Yes |
No |
| Provides COM Interfaces accessible from any language | Yes |
No |
| Enumerate process’ modules | Yes |
Yes |
| Enumerate module’s exported functions | Yes |
No |
| Get module path and info | Yes |
Yes |
| Automated call of original function | Yes |
No |
| Thread Deadlock Block | Yes |
Yes |
| 64 bits support | No |
Yes |
| Thread Safe Hook Install | Yes |
No |
| Native Support | Yes |
Partially |
| Inter-Process Communication | Yes |
Partially |
| Custom Library Injection | Yes |
Yes |
| Stealth Support | No |
Yes |
| Kernel Mode Hook | No |
Yes |
| Driver Installation | No |
Yes |
| Relocation of Instruction Pointer | Yes |
No |
| Requires .Net Framework | No |
Yes |
| Use System Runtimes (CRT) | Yes |
No |
| Hook Terminal Sessions | No |
Yes |
| Full unload before target termination. | Yes |
No |
| Execute As Service | No |
Yes |
| Prevent execution inside OS Loader | No |
Yes |
| Thread selection filter | No |
Yes |
| StackTrace | Yes |
Yes |
| User-mode Wide Hook | Yes |
No |
Yes
No
Partially
I believed to know about hooking code until reading this functionality table. Where can I learn more about each of the listed features?