Awesome Open Source
Awesome Open Source


The first Linux hooking framework to allow merging two binary files into one!

How is this different?

Other hooking methods do not allow calling libraries from within the hook, so you must resort to writing shellcode or your own implementation for libc APIs. This is not the case with GLORYHook. Check out hook.c, you can call any libc API you want!

Use cases

  1. Debugging - Can't use LD_PRELOAD? Don't want to mess with injecting dependency shared objects and can't bother installing dependency libraries on the system each time? Just hook your file instantly and ship it with zero extra steps.
  2. File Infection/Backdoor - Can be used as an alternative for an LD_PRELOAD rootkit but with extra stealth sauce. Defenders contact me for how to detect.

Important Notes

GLORYHook supports only x64. Currently hooking is only supported on imports (e.g. libc functions). Currently interacting with globals in your hook is unsupported but will be added soon.


  1. Install my custom LIEF (I customized LIEF to make ELF manipulations easier):
git clone
python3 ./ install
  1. pip3 install -r requirements.txt



  1. Define gloryhook_<import_to_hook> in your hook file
  2. gcc -shared -zrelro -znow hook.c -o hook
  3. python3 ./file-to-hook ./hook -o ./hooked-file

Check hook.c and


Get A Weekly Email With Trending Projects For These Topics
No Spam. Unsubscribe easily at any time.
python (55,580
linux (2,576
elf (50
hooking (40