How bytedance/android-inline-hook works
ShadowHook is an Android inline-hooking library: an app initializes it, identifies a function or instruction to hook, and supplies a proxy or interceptor; the library resolves the target, installs architecture-specific code, and routes execution through the replacement. The graph also preserves documented linker monitoring, recording, symbol lookup, and recursion-management capabilities. Paths for these less-sampled subsystems are supported by the tree and README, but their internal call wiring is not inferred beyond documented behavior.
Main entry points: shadowhook.c Hook coordinator · sh_linker.c Linker monitor · ShadowHook.java Java facade · sh_inst.c ARM rewriting
Components 20
App interface
- Java facade
shadowhook/src/main/java/com/bytedance/shadowhook/ShadowHook.java - JNI bridge
shadowhook/src/main/cpp/sh_jni.c - Native API
shadowhook/src/main/cpp/include/shadowhook.h
Hook engine
- Hook coordinator
shadowhook/src/main/cpp/shadowhook.c - Hook registry
shadowhook/src/main/cpp/sh_hub.c - Hook entry
shadowhook/src/main/cpp/sh_enter.c - ELF resolver
shadowhook/src/main/cpp/sh_elf.c - Symbol lookup
shadowhook/src/main/cpp/sh_xdl.c - ARM rewriting
shadowhook/src/main/cpp/arch/arm/sh_inst.c - ARM64 rewriting
shadowhook/src/main/cpp/arch/arm64/sh_inst.c - Trampolines
shadowhook/src/main/cpp/common/sh_trampo.c - Branch islands
shadowhook/src/main/cpp/sh_island.c
Platform integration
- Linker monitor
shadowhook/src/main/cpp/sh_linker.c - Deferred tasks
shadowhook/src/main/cpp/sh_task.c
Runtime support
- Operation recorder
shadowhook/src/main/cpp/sh_recorder.c - Proxy management
shadowhook/src/main/cpp/sh_switch.c - Error reporting
shadowhook/src/main/cpp/common/sh_errno.c
Other components
- Android app
- Loaded ELF
- Android linker
Connections 24
- Android app → Java facade: calls
- Java facade → JNI bridge: bridges to
- JNI bridge → Hook coordinator: invokes
- Android app → Native API: calls
- Native API → Hook coordinator: exposes
- Hook coordinator → ELF resolver: resolves targets
- Hook coordinator → Hook registry: manages hooks
- Hook coordinator → Hook entry: installs hooks
- Hook coordinator → ARM rewriting: rewrites ARM
- Hook coordinator → ARM64 rewriting: rewrites ARM64
- ARM rewriting → Trampolines: builds trampolines
- ARM64 rewriting → Trampolines: builds trampolines
- ARM rewriting → Branch islands: allocates islands
- ARM64 rewriting → Branch islands: allocates islands
- ELF resolver → Symbol lookup: looks up symbols
- Hook coordinator → Linker monitor: registers callbacks
- Android linker → Linker monitor: monitors loads
- Linker monitor → Loaded ELF: observes lifecycle
- Linker monitor → Deferred tasks: schedules work
- Deferred tasks → Hook coordinator: runs deferred hooks
- Hook coordinator → Operation recorder: records operations
- Hook coordinator → Proxy management: manages proxy calls
- Hook coordinator → Error reporting: reports errors
- Java facade → Operation recorder: retrieves records