What is the difference between a hook and a code injection?


I would define a hook as:

A piece of code which changes the response to a certain event, without changing the original code that caused the event

How is that different than "code injection", if at all?

AFAIK, both terms are quite common in software development.

Why should this post be closed?


This is a bit like asking: How is a flower different from a plant? Hooking is a technique that can be used for code injection. But not all techniques for code injection are hooks. For example, buffer overflow bugs or specially crafted malicious input data can be exploited to inject code, yet they are not hooks. (Also: , ‭elgonzo‭ about 1 month ago

Also, all hooks are not used for code injection. ‭Lundin‭ about 1 month ago

Since words often mean different things in different contexts, please be sure to clearly convey the context you are asking about: What does SD stand for? Service Design? ‭meriton‭ about 1 month ago

@meriton (On the Software Development site, can we assume that's what SD stands for?) ‭r~~‭ about 1 month ago

@elgonzo, I think your comment should be an answer ; you might even want to sum some of it as "every hook is a code injection but not every code injection is a hook". ‭JohnDoea‭ about 1 month ago

2 answers


I believe the term "hook" comes from the Windows API where you can register "hooks" - callback functions - to respond to certain events, optionally replacing the original behavior. Not necessarily other processes, it could also be hardware events etc.

If you wish to respond to events occurring inside another process though, that isn't possible because you aren't generally allowed to act on things occurring outside your own process' address space.

One way to perform code injection is through hooks - by placing your code inside a DLL, then somehow trick the other process into loading your DLL by the means of a listening to DLL events through hooks. Then the code inside the DLL will end up existing in the same process as the one you wish to respond to and it can then listen and interact to things going on in that process.

You can also do other forms of "DLL injection" that attaches a DLL to a process, but doesn't modify the other process/program.

Traditional code injection is rather done by appending your own program to the other process' executable, then abuse some API call or other vulnerability so that the process will call code placed inside the appended part of it's own address space. This is how old time computer viruses worked, and old time anti-virus software would simply scan executables looking for binary sequences of known viruses at the end.

1 comment

I'm fairly sure the term existed at least as early as the eighties. ‭dmckee‭ 24 days ago


A "hook" is a method provided by the developer a piece of software so that developers can easily write software which modifies the behavior of that software to fit their particular requirements.

Contrasted with this, "code injection" is a technique to modify the behavior of a piece of software in an unapproved manner and in ways unintended by the original developer of the software.


Hooking as a technique is not necessarily approved or an intentional part of the software design by the developer as this answer suggest. Hooking can also be done in a manner unintended/unapproved by the original developer, for example by jump splicing; although, modern security features of CPUs (such as NX/XD bit, ASLR, for example) can make it difficult/impossible to manipulate code instructions in this way... ‭elgonzo‭ about 1 month ago

In case of Windows, it's a method provided by the OS, but can be used to modify the behavior of other programs. ‭Lundin‭ about 1 month ago

Sign up to answer this question »