# bytedance/android-inline-hook architecture

> Architecture diagram of the GitHub repository bytedance/android-inline-hook, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/bytedance/android-inline-hook
- Repository: https://github.com/bytedance/android-inline-hook

## Overview

ShadowHook is an Android inline-hooking library: an app initializes it, identifies a function or instruction to hook, and supplies a proxy or interceptor; the library resolves the target, installs architecture-specific code, and routes execution through the replacement. The graph also preserves documented linker monitoring, recording, symbol lookup, and recursion-management capabilities. Paths for these less-sampled subsystems are supported by the tree and README, but their internal call wiring is not inferred beyond documented behavior.

Main entry points: [`shadowhook/src/main/cpp/shadowhook.c`](https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/shadowhook.c) (Hook coordinator), [`shadowhook/src/main/cpp/sh_linker.c`](https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/sh_linker.c) (Linker monitor), [`shadowhook/src/main/java/com/bytedance/shadowhook/ShadowHook.java`](https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/java/com/bytedance/shadowhook/ShadowHook.java) (Java facade), [`shadowhook/src/main/cpp/arch/arm/sh_inst.c`](https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/arch/arm/sh_inst.c) (ARM rewriting)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_api["App interface"]
  node_java["Java facade<br/>[ShadowHook.java]"]
  node_jni["JNI bridge<br/>[sh_jni.c]"]
  node_public_api["Native API<br/>[shadowhook.h]"]
end

subgraph group_engine["Hook engine"]
  node_core["Hook coordinator<br/>[shadowhook.c]"]
  node_hub["Hook registry<br/>[sh_hub.c]"]
  node_entry["Hook entry<br/>[sh_enter.c]"]
  node_resolver["ELF resolver<br/>[sh_elf.c]"]
  node_xdl["Symbol lookup<br/>[sh_xdl.c]"]
  node_arm_rewrite["ARM rewriting<br/>[sh_inst.c]"]
  node_arm64_rewrite["ARM64 rewriting<br/>[sh_inst.c]"]
  node_trampoline["Trampolines<br/>[sh_trampo.c]"]
  node_island["Branch islands<br/>[sh_island.c]"]
end

subgraph group_platform["Platform integration"]
  node_linker["Linker monitor<br/>[sh_linker.c]"]
  node_task["Deferred tasks<br/>[sh_task.c]"]
end

subgraph group_support["Runtime support"]
  node_recorder["Operation recorder<br/>[sh_recorder.c]"]
  node_recursion["Proxy management<br/>[sh_switch.c]"]
  node_errors["Error reporting<br/>[sh_errno.c]"]
end

node_app(("Android app"))
node_loaded_elf["Loaded ELF"]
node_linker_service["Android linker"]

node_app -->|"calls"| node_java
node_java -->|"bridges to"| node_jni
node_jni -->|"invokes"| node_core
node_app -->|"calls"| node_public_api
node_public_api -->|"exposes"| node_core
node_core -->|"resolves targets"| node_resolver
node_core -->|"manages hooks"| node_hub
node_core -->|"installs hooks"| node_entry
node_core -->|"rewrites ARM"| node_arm_rewrite
node_core -->|"rewrites ARM64"| node_arm64_rewrite
node_arm_rewrite -->|"builds trampolines"| node_trampoline
node_arm64_rewrite -->|"builds trampolines"| node_trampoline
node_arm_rewrite -->|"allocates islands"| node_island
node_arm64_rewrite -->|"allocates islands"| node_island
node_resolver -->|"looks up symbols"| node_xdl
node_core -->|"registers callbacks"| node_linker
node_linker_service -->|"monitors loads"| node_linker
node_linker -->|"observes lifecycle"| node_loaded_elf
node_linker -->|"schedules work"| node_task
node_task -->|"runs deferred hooks"| node_core
node_core -->|"records operations"| node_recorder
node_core -->|"manages proxy calls"| node_recursion
node_core -->|"reports errors"| node_errors
node_java -->|"retrieves records"| node_recorder

click node_java "https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/java/com/bytedance/shadowhook/ShadowHook.java"
click node_jni "https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/sh_jni.c"
click node_public_api "https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/include/shadowhook.h"
click node_core "https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/shadowhook.c"
click node_hub "https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/sh_hub.c"
click node_entry "https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/sh_enter.c"
click node_resolver "https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/sh_elf.c"
click node_xdl "https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/sh_xdl.c"
click node_arm_rewrite "https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/arch/arm/sh_inst.c"
click node_arm64_rewrite "https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/arch/arm64/sh_inst.c"
click node_trampoline "https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/common/sh_trampo.c"
click node_island "https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/sh_island.c"
click node_linker "https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/sh_linker.c"
click node_task "https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/sh_task.c"
click node_recorder "https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/sh_recorder.c"
click node_recursion "https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/sh_switch.c"
click node_errors "https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/common/sh_errno.c"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_java,node_jni,node_public_api toneBlue
class node_core,node_hub,node_entry,node_resolver,node_xdl,node_arm_rewrite,node_arm64_rewrite,node_trampoline,node_island toneAmber
class node_linker,node_task toneMint
class node_recorder,node_recursion,node_errors toneRose
class node_app,node_loaded_elf,node_linker_service toneIndigo
```

## Components

### App interface

- [Java facade](https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/java/com/bytedance/shadowhook/ShadowHook.java): `shadowhook/src/main/java/com/bytedance/shadowhook/ShadowHook.java`
- [JNI bridge](https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/sh_jni.c): `shadowhook/src/main/cpp/sh_jni.c`
- [Native API](https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/include/shadowhook.h): `shadowhook/src/main/cpp/include/shadowhook.h`

### Hook engine

- [Hook coordinator](https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/shadowhook.c): `shadowhook/src/main/cpp/shadowhook.c`
- [Hook registry](https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/sh_hub.c): `shadowhook/src/main/cpp/sh_hub.c`
- [Hook entry](https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/sh_enter.c): `shadowhook/src/main/cpp/sh_enter.c`
- [ELF resolver](https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/sh_elf.c): `shadowhook/src/main/cpp/sh_elf.c`
- [Symbol lookup](https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/sh_xdl.c): `shadowhook/src/main/cpp/sh_xdl.c`
- [ARM rewriting](https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/arch/arm/sh_inst.c): `shadowhook/src/main/cpp/arch/arm/sh_inst.c`
- [ARM64 rewriting](https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/arch/arm64/sh_inst.c): `shadowhook/src/main/cpp/arch/arm64/sh_inst.c`
- [Trampolines](https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/common/sh_trampo.c): `shadowhook/src/main/cpp/common/sh_trampo.c`
- [Branch islands](https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/sh_island.c): `shadowhook/src/main/cpp/sh_island.c`

### Platform integration

- [Linker monitor](https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/sh_linker.c): `shadowhook/src/main/cpp/sh_linker.c`
- [Deferred tasks](https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/sh_task.c): `shadowhook/src/main/cpp/sh_task.c`

### Runtime support

- [Operation recorder](https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/sh_recorder.c): `shadowhook/src/main/cpp/sh_recorder.c`
- [Proxy management](https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/sh_switch.c): `shadowhook/src/main/cpp/sh_switch.c`
- [Error reporting](https://github.com/bytedance/android-inline-hook/blob/main/shadowhook/src/main/cpp/common/sh_errno.c): `shadowhook/src/main/cpp/common/sh_errno.c`

### Other components

- **Android app**
- **Loaded ELF**
- **Android linker**

## Connections

- Android app → Java facade: calls
- Java facade → JNI bridge: bridges to
- JNI bridge → Hook coordinator: invokes
- Android app → Native API: calls
- Native API → Hook coordinator: exposes
- Hook coordinator → ELF resolver: resolves targets
- Hook coordinator → Hook registry: manages hooks
- Hook coordinator → Hook entry: installs hooks
- Hook coordinator → ARM rewriting: rewrites ARM
- Hook coordinator → ARM64 rewriting: rewrites ARM64
- ARM rewriting → Trampolines: builds trampolines
- ARM64 rewriting → Trampolines: builds trampolines
- ARM rewriting → Branch islands: allocates islands
- ARM64 rewriting → Branch islands: allocates islands
- ELF resolver → Symbol lookup: looks up symbols
- Hook coordinator → Linker monitor: registers callbacks
- Android linker → Linker monitor: monitors loads
- Linker monitor → Loaded ELF: observes lifecycle
- Linker monitor → Deferred tasks: schedules work
- Deferred tasks → Hook coordinator: runs deferred hooks
- Hook coordinator → Operation recorder: records operations
- Hook coordinator → Proxy management: manages proxy calls
- Hook coordinator → Error reporting: reports errors
- Java facade → Operation recorder: retrieves records