kubo / funchook Goto Github PK

View Code? Open in Web Editor NEW

606.0 21.0 89.0 333 KB

Hook function calls by inserting jump instructions at runtime

License: Other

Shell 0.66% C 80.94% Assembly 10.16% CMake 4.82% Makefile 0.23% Ruby 0.54% C++ 2.66%

hooking hook x86-64 x86-32 arm64

funchook's People

Contributors

Stargazers

Watchers

Forkers

startion2007 rain6851 elderapo koncybernet realmadaha minecraft-linux dd181818 verofess jeffli678 fengjixuchui 26597925 drdavella seemk yuzehome bakkesmodorg frago9876543210 fabioz elwin-mao timpalpant p5-vbnekit peterg75 zhangxp1998 st-rnd dexter4life igorkey 5l1v3r1 ialbertocamilo raystyle fcccode bbbking abhisheknishantpuresoftware linfenwen webstorage119 idkwim huy-im juneburning ra2003 diewelle1107 lazorchakp gavz xgreat crackercat cronos996 xeno6696 xiaoshzx shun16888 asdlei99 jilvan1234 5433d-r32433 braaandon dreamswork useful-stuff rumblehhh lidotcircle kefins speedy37 adfernandes clayne nkr00711 terrawilly inclooder bobyang824 firedtoad nzcv data-gami junedic refo0 dkjnsdvsodvnosdvm stackoverflowexcept1on lemonloader bbaslayer michalbiesek gmh5225 hzmslx shonker jiangtao89 navytux binlmmhc houxinlin satisfactorymodding a7t0fwa7 github-lhd crackedmatter redthing1 levisre axax002

funchook's Issues

funchook_error_message declared but not defined

The function funchook_error_message is declared in funchook.h but not defined anywhere. I can't get to the error message directly since funchook_t is an opaque type.

install hook on any address

can i use funchook to install a hook on the address not only function begin?
like this:

send_func = (uchar*)send + 5;

yet another API hook library: mollismerx/elfspy

Hi @kubo! You might want to add mollismerx/elfspy to the List of API Hook Libraries

Unable to prepare more than one hook [Windows]

If you have multiple funchook_prepare, the first one is created, but the following ones are using the same entry->trampoline pointer. While I agree you should be able to use a single page for multiple hooks it doesn't look like the code actually supports it.

From the log
Enter funchook_prepare(0x40300000, 0x7ffb6cc01938, 0x7ffb6c9912e6)
Leave funchook_prepare(..., [0x402cb420->0x403d2020],...) => 0
Enter funchook_prepare(0x40310000, 0x7ffb6cc01948, 0x7ffb6c991449)
Leave funchook_prepare(..., [0x402cb5f0->0x403d2020],...) => 0
Enter funchook_prepare(0x40320000, 0x7ffb6cc01958, 0x7ffb6c99444b)
Leave funchook_prepare(..., [0x402cb7c0->0x403d2020],...) => 0

This might also explain when you try to destroy multiple funchoot_t's it results in memory read exceptions.

You calculate the number of entries a page can contain, but from what I can tell only one entry is allocated.
funchook_entry_t entries[1];

In the code below there is a page available it uses it, but no where does it dictate that the trampoline should be adjusted to X bytes into the page. Which results in overwriting the pointer of the previous prepare call().

//Forgive formatting, github markup was jacking up the new lines.
for (pl = page_list.next; pl != &page_list; pl = pl->next) {

  for (i = 0; i < max_num_pages; i++) {
        if (!pl->used[i]) {
            page = (funchook_page_t *)((size_t)pl + (i + 1) * page_size);
            if (funchook_page_avail(funchook, page, 0, func, disp)) {
                break;
            }
        }
    }
}`

In the interim, after this call I just set page to NULL and let a new page get allocated for each prepare call.

I don't mind submitting a pull request, but I'm not sure based on your design how you would prefer it to be fixed.

One hook for multiple targets - feature request

Given a list of function addresses at runtime I need to log whenever any of them is called. I believe the best way to do this would be to hook the functions with a logger hook. After some discussion it looks like this ideally would be enabled by a hooking library.

However, with current API of this library, it is impossible to have one hook function for multiple targets, as the hook function does not have the information about the hooked function (in particular its address).

I would like to propose a feature, that would make it possible not only to write this:

void hook(int arg1, int arg2)
{
  ...
  original_function(arg1, arg2);
}

but also this:

void multihook(fun_ptr_t ptr, int arg1, int arg2)
{
  ...
  ptr(arg1, arg2)
}

The address of the original function could be passed in any other way, not necessarily as the first argument.

Could this be implemented as part of this library? If so, what would be the best way to approach it?

Can this project be installed offline？

Is there any plan to support 32-bit ARM?

hi,I want to use this project on arm32 platform,but it seems not supported yet.What should I do to support arm32?
thanks.

Example for mac os

Hi, can you give me an example for mac os?
I want to change path when open a file: if user open file A, it will display file B.
How can I do that?
Thank you.

Failed to hook "connect" function of libmysqlclient.21.dylib On MacOS

I wrote a sample using funchook library to hook "socket/connect" api correctly. When I replaced the basic logic of socket and connect with calling api of libmysqlclient.dylib , the socket api hook takes effect , but connect api hook does not.

Simple hook fails

static int (*recv_func)(int test);

int recv(int test) {
    return test;
}


static int recv_hook(int test) {
    ssize_t rv;

    rv = recv_func(test); /* call the original recv(). */
    return rv;
}

int install_hooks() {
    funchook_t *funchook = funchook_create();
    int rv;

    /* Prepare hooking.
     * The return value is used to call the original send function
     * in send_hook.
     */

    /* ditto */
    recv_func = recv;
    rv = funchook_prepare(funchook, (void **) &recv_func, (void *) recv_hook);
    if (rv != 0) {
        /* error */
        fmt_println("Failed to prepare hook.");
        return 1;
    }

    /* Install hooks.
     * The first 5-byte code of send() and recv() are changed respectively.
     */
    rv = funchook_install(funchook, 0);
    if (rv != 0) {
        fmt_println("Failed to install hook.");
        return 1;
    }

    return 0;
}

Compiler:

-- The C compiler identification is GNU 11.2.0
-- The ASM compiler identification is GNU
-- Found assembler: C:/dev-tools/mingw64/bin/gcc.exe
-- Detecting C compiler ABI info
-- Detecting C compiler ABI info - done
-- Check for working C compiler: C:/dev-tools/mingw64/bin/gcc.exe - skipped
-- Detecting C compile features
-- Detecting C compile features - done
-- Performing Test HAVE_FVISIBILITY_HIDDEN
-- Performing Test HAVE_FVISIBILITY_HIDDEN - Success
-- Configuring done
-- Generating done

Output:
Failed to prepare hook.

Why that simple hook fails? What i'm doing wrong?

static compilation error

hi. when I am trying compile a shared library with static libfunchook.a I have compilation errors
can you solve it ?
gcc -o mydll.so mydll.c -fPIC -shared -L. -lfunchook -D_GNU_SOURCE
/usr/bin/ld: ./libfunchook.a(funchook.c.o): relocation R_X86_64_32 against .rodata.str1.1' can not be used when making a shared object; recompile with -fPIC /usr/bin/ld: ./libfunchook.a(funchook_x86.c.o): relocation R_X86_64_32 against .rodata.str1.1' can not be used when making a shared object; recompile with -fPIC
/usr/bin/ld: ./libfunchook.a(funchook_unix.c.o): relocation R_X86_64_32 against .rodata.str1.1' can not be used when making a shared object; recompile with -fPIC /usr/bin/ld: ./libfunchook.a(disasm_distorm.c.o): relocation R_X86_64_32 against .rodata.str1.1' can not be used when making a shared object; recompile with -fPIC
/usr/bin/ld: final link failed: nonrepresentable section on output
collect2: error: ld returned 1 exit status

Can't link when used by a C++ project

Hi there, I was giving your API hook library a try and could not get linking to work (my project is using C++). After quite a bit of digging I found that the problem was C++ name mangling of the function declarations in funchook.h.

You can fix this by adding the following to explicitly use C-linkage conventions:

#ifdef __cplusplus
extern "C" {
#endif

... Your function declarations here ...

#ifdef __cplusplus
} // extern "C"
#endif

Support calls with unaligned stack on x86

As far as I can see, on x86, this library assumes that target functions will always be called with %rsp properly aligned.

However, some of the functions I'd like to hook are called with %rsp unaligned. If transit function is not used, it jumps to the hook function and the stack is still unaligned. This may cause issues.

It gets even worse when the transit procedure is used, as it contains movdqa instructions which immediately segfault.

From what I can see, to support this, one needs to:

force transit usage
add code to check and fix alignment in the transit function.

Is this right?

License change?

I'd like to be able to use this library, but my company prohibits use of GPL software, even with the linking exception.

Would you consider a change to a more permissive license, such as MIT, BSD 3-clause, Apache 2.0 or ISC?

Thanks

Replace a function without reference to it

I need to replace a function in a shared object library (ruby). I'm not sure how to get a function handle for the particular function so that I can replace it.

It's buried in the SO.

Can you please point me in the right direction? I can find the function in the SO via readelf, but the address doesn't match at runtime.

Can you add support for Windows ARM64?

Are there any plans to provide support for the MIPS64 architecture ?

This is a very good project, do you have any plans to support mips64 architecture?

MinGW cmake disaster? Invalid command line switch for "cmd.exe". System.ArgumentException: Item has already been added. Key in dictionary: 'TEMP' Key being added: 'temp'

$ cmake --build . --config Release --target INSTALL
Microsoft (R) Build Engine version 16.8.2+25e4d540b for .NET Framework
Copyright (C) Microsoft Corporation. All rights reserved.

  distorm.vcxproj -> C:\Users\Brandon\Desktop\funchook\Release\distorm.lib
  funchook.c
  funchook_x86.c
  funchook_windows.c
  disasm_distorm.c
  Generating Code...
     Creating library C:/Users/Brandon/Desktop/funchook/Release/funchook_dll.lib and object C:/Users/Brandon/Desktop/funchook/Release/funchook_dll.exp
  funchook-shared.vcxproj -> C:\Users\Brandon\Desktop\funchook\Release\funchook.dll
  funchook.c
  funchook_x86.c
  funchook_windows.c
  disasm_distorm.c
  Generating Code...
  funchook-static.vcxproj -> C:\Users\Brandon\Desktop\funchook\Release\funchook.lib
  funchook_test.vcxproj -> C:\Users\Brandon\Desktop\funchook\test\Release\funchook_test_dll.dll
C:\Program Files (x86)\Microsoft Visual Studio\2019\BuildTools\MSBuild\Microsoft\VC\v160\Microsoft.CppCommon.targets(238,5): error MSB6001: Invalid command line switch for "cmd.exe". System.ArgumentException: Item has already been added. Key in dictionary: 'TEMP'  Key being added: 'temp' [C:\Users\Brandon\Desktop\funchook\test\funchook_test_shared.vcxproj]
C:\Program Files (x86)\Microsoft Visual Studio\2019\BuildTools\MSBuild\Microsoft\VC\v160\Microsoft.CppCommon.targets(238,5): error MSB6001:    at System.Collections.Hashtable.Insert(Object key, Object nvalue, Boolean add) [C:\Users\Brandon\Desktop\funchook\test\funchook_test_shared.vcxproj]
C:\Program Files (x86)\Microsoft Visual Studio\2019\BuildTools\MSBuild\Microsoft\VC\v160\Microsoft.CppCommon.targets(238,5): error MSB6001:    at System.Collections.Hashtable.Add(Object key, Object value) [C:\Users\Brandon\Desktop\funchook\test\funchook_test_shared.vcxproj]
C:\Program Files (x86)\Microsoft Visual Studio\2019\BuildTools\MSBuild\Microsoft\VC\v160\Microsoft.CppCommon.targets(238,5): error MSB6001:    at System.Collections.Specialized.StringDictionaryWithComparer.Add(String key, String value) [C:\Users\Brandon\Desktop\funchook\test\funchook_test_shared.vcxproj]
C:\Program Files (x86)\Microsoft Visual Studio\2019\BuildTools\MSBuild\Microsoft\VC\v160\Microsoft.CppCommon.targets(238,5): error MSB6001:    at System.Diagnostics.ProcessStartInfo.get_EnvironmentVariables() [C:\Users\Brandon\Desktop\funchook\test\funchook_test_shared.vcxproj]
C:\Program Files (x86)\Microsoft Visual Studio\2019\BuildTools\MSBuild\Microsoft\VC\v160\Microsoft.CppCommon.targets(238,5): error MSB6001:    at Microsoft.Build.Utilities.ToolTask.GetProcessStartInfo(String pathToTool, String commandLineCommands, String responseFileSwitch) [C:\Users\Brandon\Desktop\funchook\test\funchook_test_shared.vcxproj]
C:\Program Files (x86)\Microsoft Visual Studio\2019\BuildTools\MSBuild\Microsoft\VC\v160\Microsoft.CppCommon.targets(238,5): error MSB6001:    at Microsoft.Build.Utilities.ToolTask.ExecuteTool(String pathToTool, String responseFileCommands, String commandLineCommands) [C:\Users\Brandon\Desktop\funchook\test\funchook_test_shared.vcxproj]
C:\Program Files (x86)\Microsoft Visual Studio\2019\BuildTools\MSBuild\Microsoft\VC\v160\Microsoft.CppCommon.targets(238,5): error MSB6001:    at Microsoft.Build.CPPTasks.TrackedVCToolTask.TrackerExecuteTool(String pathToTool, String responseFileCommands, String commandLineCommands) [C:\Users\Brandon\Desktop\funchook\test\funchook_test_shared.vcxproj]
C:\Program Files (x86)\Microsoft Visual Studio\2019\BuildTools\MSBuild\Microsoft\VC\v160\Microsoft.CppCommon.targets(238,5): error MSB6001:    at Microsoft.Build.CPPTasks.CustomBuild.ExecuteTool(String pathToTool, String responseFileCommands, String commandLineCommands) [C:\Users\Brandon\Desktop\funchook\test\funchook_test_shared.vcxproj]
C:\Program Files (x86)\Microsoft Visual Studio\2019\BuildTools\MSBuild\Microsoft\VC\v160\Microsoft.CppCommon.targets(238,5): error MSB6001:    at Microsoft.Build.Utilities.ToolTask.Execute() [C:\Users\Brandon\Desktop\funchook\test\funchook_test_shared.vcxproj]
C:\Program Files (x86)\Microsoft Visual Studio\2019\BuildTools\MSBuild\Microsoft\VC\v160\Microsoft.CppCommon.targets(238,5): error MSB6001: Invalid command line switch for "cmd.exe". System.ArgumentException: Item has already been added. Key in dictionary: 'TEMP'  Key being added: 'temp' [C:\Users\Brandon\Desktop\funchook\test\funchook_test_static.vcxproj]
C:\Program Files (x86)\Microsoft Visual Studio\2019\BuildTools\MSBuild\Microsoft\VC\v160\Microsoft.CppCommon.targets(238,5): error MSB6001:    at System.Collections.Hashtable.Insert(Object key, Object nvalue, Boolean add) [C:\Users\Brandon\Desktop\funchook\test\funchook_test_static.vcxproj]
C:\Program Files (x86)\Microsoft Visual Studio\2019\BuildTools\MSBuild\Microsoft\VC\v160\Microsoft.CppCommon.targets(238,5): error MSB6001:    at System.Collections.Hashtable.Add(Object key, Object value) [C:\Users\Brandon\Desktop\funchook\test\funchook_test_static.vcxproj]
C:\Program Files (x86)\Microsoft Visual Studio\2019\BuildTools\MSBuild\Microsoft\VC\v160\Microsoft.CppCommon.targets(238,5): error MSB6001:    at System.Collections.Specialized.StringDictionaryWithComparer.Add(String key, String value) [C:\Users\Brandon\Desktop\funchook\test\funchook_test_static.vcxproj]
C:\Program Files (x86)\Microsoft Visual Studio\2019\BuildTools\MSBuild\Microsoft\VC\v160\Microsoft.CppCommon.targets(238,5): error MSB6001:    at System.Diagnostics.ProcessStartInfo.get_EnvironmentVariables() [C:\Users\Brandon\Desktop\funchook\test\funchook_test_static.vcxproj]
C:\Program Files (x86)\Microsoft Visual Studio\2019\BuildTools\MSBuild\Microsoft\VC\v160\Microsoft.CppCommon.targets(238,5): error MSB6001:    at Microsoft.Build.Utilities.ToolTask.GetProcessStartInfo(String pathToTool, String commandLineCommands, String responseFileSwitch) [C:\Users\Brandon\Desktop\funchook\test\funchook_test_static.vcxproj]
C:\Program Files (x86)\Microsoft Visual Studio\2019\BuildTools\MSBuild\Microsoft\VC\v160\Microsoft.CppCommon.targets(238,5): error MSB6001:    at Microsoft.Build.Utilities.ToolTask.ExecuteTool(String pathToTool, String responseFileCommands, String commandLineCommands) [C:\Users\Brandon\Desktop\funchook\test\funchook_test_static.vcxproj]
C:\Program Files (x86)\Microsoft Visual Studio\2019\BuildTools\MSBuild\Microsoft\VC\v160\Microsoft.CppCommon.targets(238,5): error MSB6001:    at Microsoft.Build.CPPTasks.TrackedVCToolTask.TrackerExecuteTool(String pathToTool, String responseFileCommands, String commandLineCommands) [C:\Users\Brandon\Desktop\funchook\test\funchook_test_static.vcxproj]
C:\Program Files (x86)\Microsoft Visual Studio\2019\BuildTools\MSBuild\Microsoft\VC\v160\Microsoft.CppCommon.targets(238,5): error MSB6001:    at Microsoft.Build.CPPTasks.CustomBuild.ExecuteTool(String pathToTool, String responseFileCommands, String commandLineCommands) [C:\Users\Brandon\Desktop\funchook\test\funchook_test_static.vcxproj]
C:\Program Files (x86)\Microsoft Visual Studio\2019\BuildTools\MSBuild\Microsoft\VC\v160\Microsoft.CppCommon.targets(238,5): error MSB6001:    at Microsoft.Build.Utilities.ToolTask.Execute() [C:\Users\Brandon\Desktop\funchook\test\funchook_test_static.vcxproj]

Errors when compiling on MacOs for arm64 with clang

I am using funchook as a dependency for building: https://github.com/metacall/core

Apparently there's an issue when building for MacOs with clang, here's the issue:
metacall/core#381

Any idea of what could be the problem? I just tried to update the version for now.

funchook won't build on alpine linux

When I attempt to build funchook on Alpine linux I get the following error:

funchook_unix.c: In function 'funchook_strerror':
funchook_unix.c:455:33: error: 'sys_nerr' undeclared (first use in this function); did you mean 'stderr'?
     if (0 <= errnum && errnum < sys_nerr) {
                                 ^~~~~~~~
                                 stderr
funchook_unix.c:455:33: note: each undeclared identifier is reported only once for each function it appears in
funchook_unix.c:456:16: error: 'sys_errlist' undeclared (first use in this function)
         return sys_errlist[errnum];
                ^~~~~~~~~~~

If I remove these lines the package builds just fine. It seems like using _sys_errlist and sys_errlist is non-standard. Is there any reason not to just use strerror instead?

Failed to unprotect memory

#include <funchook.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

static int  (*getpid_func)();

static int getpid_hook() {
    printf("origin getpid==%d\n",getpid_func());
    return 0;
}

int main() {
    funchook_t *funchook = funchook_create();

    getpid_func = getpid;
    funchook_prepare(funchook, (void**)&getpid_func, getpid_hook);

    if (funchook_install(funchook, 0) != FUNCHOOK_ERROR_SUCCESS) {
        printf("%s\n", funchook_error_message(funchook));
    }

    printf("%d\n",getpid());
    return 0;
}

output

Failed to unprotect memory 0xffff876d7000 (size=4096, prot=read,write,exec) <- 0xffff876d76b0 (size=8, error=Invalid argument)
3358211

usage on macOS arm64

Hello,

I am interested in getting this fully working on arm64 macOS.

I saw the issues with it mentioned earlier here:

I am building it on my machine with the following procedure:

CC=gcc-13 CXX=g++-13 cmake -G Ninja -DFUNCHOOK_DISASM=capstone -DCMAKE_BUILD_TYPE=Release -DFUNCHOOK_BUILD_TESTS=0 ..
ninja

Out of the box, it fails with this error:

/code/funchook/src/prehook-arm64-gas.S:4:2: error: unknown directive
 .type funchook_hook_caller_asm, %function
 ^

I was indeed able to build the main library, but I had to make some changes to the assembly:

diff --git a/src/prehook-arm64-gas.S b/src/prehook-arm64-gas.S
index de39edb..dbdb717 100644
--- a/src/prehook-arm64-gas.S
+++ b/src/prehook-arm64-gas.S
@@ -1,8 +1,8 @@
        .arch armv8-a
        .text
-       .globl  funchook_hook_caller_asm
-       .type   funchook_hook_caller_asm, %function
-funchook_hook_caller_asm:
+       .globl  _funchook_hook_caller_asm
+       ; .type _funchook_hook_caller_asm, %function
+_funchook_hook_caller_asm:
        .cfi_startproc
        // save frame pointer (x29) and link register (x30).
        stp x29, x30, [sp, -0xe0]!
@@ -46,7 +46,7 @@ funchook_hook_caller_asm:
        // 2nd arg: frame pointer
        mov x1, x29
        // call funchook_hook_caller
-       bl  funchook_hook_caller
+       bl  _funchook_hook_caller
        mov x9, x0
        // restore registers
        ldp x0, x1, [sp, 0x10]

This is needed to get it to link for macOS.
It seems like the supported syntax for macOS arm64 assembler is different from standard arm64 GAS syntax, so we may have to add an additional file with these changes?

I believe it should be possible to get build with tests working too, I will try that.

Tests fail to build on M1

I ran the following command on my M1 Mac:

cmake -B ./build

The result was this error:

Enabling CAPSTONE_ARM64_SUPPORT
-- Configuring done
CMake Error at test/CMakeLists.txt:33 (add_library):
  Cannot find source file:

    libfunchook_test_arm64_gas.S

  Tried extensions .c .C .c++ .cc .cpp .cxx .cu .mpp .m .M .mm .ixx .cppm .h
  .hh .h++ .hm .hpp .hxx .in .txx .f .F .for .f77 .f90 .f95 .f03 .hip .ispc


CMake Error at test/CMakeLists.txt:33 (add_library):
  No SOURCES given to target: funchook_test

I am able to work around this by adding -DFUNCHOOK_BUILD_TESTS=0 to the cmake command.

funchook_uninstall not completing

macOS: 10.15.6
Xcode: 11.7

I am seeing something very strange when debug logging is enabled, there is no return of funchook_uninstall being logged. So it almost seems as if something wrong is happening. For instance, below, why is "Leave funchook_uninstall()" never showing up? I'm ultimately trying to figure out a crash on unhooking and I suspect this has something to do with it. Any thoughts? I haven't updated the repos since 2019, not sure if there have been significant changes on the macOS side.

Enter funchook_uninstall(0x14d34c000, 0x0)
unprotect memory 0x1755a0000 (size=4096, prot=read,write,exec) <- 0x1755a0dc0 (size=5)
protect memory 0x1755a0000 (size=4096, prot=read,exec)
unprotect page 0x1755fa000 (size=4096)
Enter funchook_uninstall(0x14d34d000, 0x0)
unprotect memory 0x1755a0000 (size=4096, prot=read,write,exec) <- 0x1755a0eb0 (size=5)
protect memory 0x1755a0000 (size=4096, prot=read,exec)
unprotect page 0x1755fb000 (size=4096)
Enter funchook_uninstall(0x14d34e000, 0x0)
unprotect memory 0x1731e7000 (size=4096, prot=read,write,exec) <- 0x1731e7160 (size=5)
protect memory 0x1731e7000 (size=4096, prot=read,exec)
unprotect page 0x1755fc000 (size=4096)

Are there any plans to provide support for the RISC-V architecture ?

I saw that RISC-V arch is supported on capstone disassembly framework.

Ubuntu: hooking freetype io

Hi there,

I'm actually hooking io stuff in my project (open/fopen, close/fclose, read/fread, lseek/fseek...) to provide a "romfs" layer on linux as on some handled consoles (vita, switch, 3ds..) for a multi-platform library.

This is working very fine for everything i have tested with this hooks, but i do have problem with the freetype library. Loading a new font with the hooks in place (fopen/fseek/ftell) is not working with the ubuntu "system freetype library" (that comes with apt), but it works fine when i compile the same version myself. The main difference i can see is when it works (with my own compiled freetype dynamic library) the "load font function" (FT_New_Face) do a call to "fopen" while the ubuntu one directly call the "open" function.

I guess it's not a bug in funchook, but my question is to know if there could be some sort of protection or whatever on the ubuntu libs, as it seems fopen hook is not called on this one.

Else, many thanks for the great project :)
cpasjuste.

Edit: i did found that when compiling my project (and so freetype) in debug mode, it's working fine, but as soon as i compile it in release mode the hooking doesn't occur.

Edit2: i did found that hooking "__fxstat" instead "fstat" does make all working fine, i'm not sure what's the problem thought.

[ 89%] Building C object third_party/funchook/test/CMakeFiles/funchook_test_static.dir/test_main.c.o
third_party/funchook/test/test_main.c:445:52: error: address of overloaded function 'open' is ambiguous
    open_func = (int (*)(const char*, int, mode_t))open;
                                                   ^~~~
/usr/include/bits/fortify/fcntl.h:74:5: note: candidate address cannot be taken because candidate address cannot be taken because parameter 1 has pass_object_size attribute
int open(const char* const __pass_object_size pathname, int flags, mode_t modes)
    ^
/usr/include/bits/fortify/fcntl.h:63:5: note: candidate address cannot be taken because candidate address cannot be taken because parameter 1 has pass_object_size attribute
int open(const char* const __pass_object_size pathname, int flags)```