Documentation > Frequently Asked Questions (FAQ) > How do I patch/hook a function?

How do I patch/hook a function?

Function hooking usually requires you to code and compile a DLL/SO file, and then inject it into the target executable somehow (e.g. manual mapping or by calling LoadLibrary on Windows, or using LD_PRELOAD or ptrace on Linux).

While these techniques do work, Binary Workbench offers a simpler solution, by patching the executable file directly:


  1. Choose a function and get the address using the disassembler or an external tool
  2. Click Hook -> Hook address
  3. Enter the function address, the callback symbol (e.g. test_cb), and the original symbol (e.g. test_orig)
  4. Click Start
  5. Click Hook -> Edit instrumentation script
  6. Create an onload() handler and the signature of your original function:
    void onload() {}
    uint64_t test_orig(uint64_t a, uint64_t b);
  7. Code your callback function in C
  8. Save the instrumentation script and click File -> Build to build the project