everdox/InfinityHook

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

2673 stars · 514 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

InfinityHook is a Windows kernel library that hooks system calls, context switches, page faults, and DPCs by abusing ETW trace mechanics, remaining compatible with Patchguard and VBS/Hyperguard. It ships as a kernel driver sample exposing a single initialization API with a user-defined callback for intercepting and redirecting system calls.

Use cases

• hook system calls in a Windows kernel driver
• monitor syscall activity without triggering Patchguard
• intercept and redirect kernel function pointers
• build kernel event tracing and monitoring tools
• research stealthy kernel hooking techniques
• observe context switches and page faults in the kernel

When to choose

• you need syscall hooking on Windows 7 through Windows 10 that survives Patchguard
• you want a minimal, portable kernel hooking library with a single callback API
• you are doing kernel security research or building monitoring/anti-cheat tooling

When to avoid

• you need a supported, licensed library for production software (no license is provided)
• you target non-Windows platforms
• you want a maintained solution guaranteed to work on the latest Windows versions
• you are not comfortable developing and loading kernel drivers

Facets

library · maturity maintenance

security reverse-engineering developer-tools security operating-systems reverse-engineering windows cpp kernel-driver rootkit etw syscall-hooking patchguard-bypass windows-kernel

Member repositories

For agents

markdown · JSON · MCP: product_card(name="everdox/InfinityHook")