Function MSHookFunction 

#[unsafe(no_mangle)]
pub unsafe extern "C" fn MSHookFunction(
    symbol: *mut c_void,
    replace: *mut c_void,
    result: *mut *mut c_void,
)

Hook a function at runtime by redirecting its execution to a replacement function.

This is the primary C-compatible hooking function that works across all supported architectures (x86-64, ARMv7, ARM64). It installs an inline hook by modifying the target function’s prologue to jump to your replacement function, while preserving the original instructions in a trampoline.

Arguments

• symbol - Pointer to the function to hook (must not be null)
• replace - Pointer to your replacement function (must not be null)
• result - Output pointer that receives the trampoline address to call the original function. Pass null if you don’t need to call the original function.

Safety

This function is unsafe because it:

• Modifies executable code at runtime
• Requires valid function pointers
• Changes memory protection flags
• Can cause undefined behavior if pointers are invalid

Examples

use substrate::MSHookFunction;
use std::os::raw::c_void;

static mut ORIGINAL: *mut c_void = std::ptr::null_mut();

unsafe extern "C" fn my_replacement() {
    println!("Hooked!");
    if !ORIGINAL.is_null() {
        let orig: extern "C" fn() = std::mem::transmute(ORIGINAL);
        orig();
    }
}

unsafe {
    let target = 0x12345678 as *mut c_void;
    MSHookFunction(target, my_replacement as *mut c_void, &mut ORIGINAL);
}

Examples found in repository

examples/library_hook.rs (lines 38-42)

fn main() {
    println!("=== Library Function Hook Example ===\n");

    println!("This example demonstrates hooking a function in a shared library.");
    println!("Note: This requires a target library to be loaded.\n");

    let library_name = "libexample.so";
    let function_offset = 0x1234;

    unsafe {
        println!("Checking if {} is loaded...", library_name);

        if utils::is_library_loaded(library_name) {
            println!("✓ Library is loaded!");

            match utils::get_absolute_address(library_name, function_offset) {
                Ok(addr) => {
                    println!("Target address: 0x{:x}", addr);
                    println!("Installing hook...");

                    MSHookFunction(
                        addr as *mut c_void,
                        my_hooked_function as *mut c_void,
                        &mut OLD_FUNCTION
                    );

                    println!("✓ Hook installed!");
                    println!("Original function: {:p}", OLD_FUNCTION);
                }
                Err(e) => {
                    eprintln!("✗ Failed to get address: {}", e);
                }
            }
        } else {
            println!("✗ Library '{}' is not loaded", library_name);
            println!("\nTo use this example:");
            println!("1. Replace 'libexample.so' with your target library");
            println!("2. Replace 0x1234 with the actual function offset");
            println!("3. Make sure the library is loaded before running");
        }
    }
}

examples/android_game_hook.rs (lines 67-71)

fn main() {
    println!("=== Android Game Hook Example (IL2CPP/Unity) ===\n");

    let library = "libil2cpp.so";

    let update_offset_str = "0x123456";
    let fixed_update_offset_str = "0x789ABC";

    println!("Waiting for {} to load...", library);

    if wait_for_library(library, 30) {
        println!("✓ {} loaded!", library);

        unsafe {
            match string_to_offset(update_offset_str) {
                Ok(update_offset) => {
                    println!("\nHooking Update() at offset: 0x{:X}", update_offset);

                    match get_absolute_address(library, update_offset) {
                        Ok(addr) => {
                            println!("Absolute address: 0x{:x}", addr);

                            MSHookFunction(
                                addr as *mut c_void,
                                hooked_update as *mut c_void,
                                &mut OLD_UPDATE
                            );

                            if !OLD_UPDATE.is_null() {
                                println!("✓ Update() hooked successfully!");
                            }
                        }
                        Err(e) => eprintln!("✗ Failed to get address: {}", e),
                    }
                }
                Err(e) => eprintln!("✗ Invalid offset: {}", e),
            }

            match string_to_offset(fixed_update_offset_str) {
                Ok(fixed_offset) => {
                    println!("\nHooking FixedUpdate() at offset: 0x{:X}", fixed_offset);

                    match get_absolute_address(library, fixed_offset) {
                        Ok(addr) => {
                            println!("Absolute address: 0x{:x}", addr);

                            MSHookFunction(
                                addr as *mut c_void,
                                hooked_fixed_update as *mut c_void,
                                &mut OLD_FIXED_UPDATE
                            );

                            if !OLD_FIXED_UPDATE.is_null() {
                                println!("✓ FixedUpdate() hooked successfully!");
                            }
                        }
                        Err(e) => eprintln!("✗ Failed to get address: {}", e),
                    }
                }
                Err(e) => eprintln!("✗ Invalid offset: {}", e),
            }

            println!("\n=== Hooks Installed ===");
            println!("The game functions will now call your hooks.");
            println!("\nNote: Replace the offset values with real ones from your game!");
        }
    } else {
        eprintln!("✗ Timeout waiting for {} to load", library);
        eprintln!("\nTo use this example:");
        eprintln!("1. Find function offsets using IDA Pro, Ghidra, or similar");
        eprintln!("2. Replace the offset strings with actual values");
        eprintln!("3. Run as part of an injected library in the game process");
    }
}