EasyHook

EasyHook is a free and open-source development component which can be integrated into personal software projects by programmers. It facilitates a simplified method for hooking unmanaged API code with pure managed one. The tool was initially designed as complementary to Microsoft Detours, a library used for intercepting arbitrary Win32 binary functions on 32-bit machines.

Extending unmanaged code from a managed environment brings several advantages to the table. For instance, resource or memory leaks will no longer be left in the target, while installing and auto-removing all hooks will be possible in a stable environment. You will be able to write pure managed hook handlers for unmanaged APIs, use NET Remoting, WCF and WPF, as well as write injection libraries and host processes compiled for AnyCPU.

The EasyHook library works on 32-bit and 64-bit Windows XP SP2, 64-bit Windows Vista, 64-bit Windows Server 2008, Windows 7 and Windows 8.1. It offers support for DLL injections along with assembly injections made for .NET Framework 3.5 and .NET Framework 4.0. It's no longer necessary to register assemblies into the Global Assembly Cache (GAC) for remote injection. However, GAC registration is still supported.

The downloaded package contains the EasyHook source code, along with an interactive process monitor, which is a simple FileMon derivate that intercepts and logs all file accesses from a given process (demo, source code and binary package).