PerformanC's simplest and most efficient PLT hooking library, written in C99.
- C99 compliant
- Low complexity
- Simple API
- Minimal traces left
bool plti_init(struct plti *ctx)
Initializes the PLTI context. Must be initialized only once per process you want to hook.
bool plti_add_lib(struct plti *ctx, const char *lib_name)
Adds a library to the PLTI context, allowing it to have its PLT entries hooked. The library must be already loaded in the process.
bool plti_add_manual_lib(struct plti *ctx, const char *lib_path, void *base_addr)
Adds a library to the PLTI context manually, in case it is not findable with dl_iterate_phdr. The library must be accessible in the file system.
bool plti_add_hook(struct plti *ctx, const char *lib_name, const char *name, void *new_callback, void **backup)
Hooks a PLT entry by its name, replacing it with the provided callback. The original function address is stored in backup if it's not NULL (permanent hook).
bool plti_add_hook_by_prefix(struct plti *ctx, const char *lib_name, const char *name_prefix, void *new_callback, void **backup)
Hooks a PLT entry by its name prefix, replacing it with the provided callback. The original function address is stored in backup if it's not NULL (permanent hook).
bool plti_remove_hook(struct plti *ctx, const char *lib_name, const char *name, void **backup)
Removes a hook from a PLT entry by its name, restoring the original function address. Same as plti_add_hook but in reverse.
bool plti_remove_hook_by_prefix(struct plti *ctx, const char *lib_name, const char *name_prefix, void **backup)
Removes a hook from a PLT entry by its name prefix, restoring the original function address. Same as plti_add_hook_by_prefix but in reverse.
bool plti_deinit(struct plti *ctx)
Deinitializes the PLTI context, freeing all allocated resources. Must be called once when you are done with all hooking operations.
Any question or issue related to PLTI or other PerformanC projects can be made in our:
It is mandatory to follow the PerformanC's contribution guidelines to contribute to PLTI. Following its Security Policy, Code of Conduct and syntax standard.
- ReZygisk: Transparent Zygisk implementation
PLTI is licensed under BSD 3-Clause License. You can read more about it on Open Source Initiative.
- This project is considered as: leading standard.