OptionalredirectUpper bound on the number of bytes that writeRedirect will need.
Your callback may end up using less. Specifying a larger value means Interceptor has to explore further to determine that it is safe to use that much space — looking for back-branches, call return sites, etc. — which is more expensive.
Defaults to the size needed for a full redirect, e.g. 16 bytes on arm64.
OptionalrelocationHow to deal with relocation of the instructions overwritten by the hook.
Defaults to checked.
OptionalscenarioWhether another thread might be executing the target while it is being instrumented.
Use online when calls may be in flight, i.e. a thread could have
executed an instruction with call semantics (CALL/BL/etc.) but not yet
returned. Use offline when that cannot happen — e.g. after spawn()
but before resume(), or when no calls will occur until some external
input you control. The offline scenario allows writing past the end of
such an instruction, which would be unsafe online.
Defaults to online.
OptionalscratchRegister that Interceptor may clobber when building the trampoline.
Only supported on architectures that expose scratch registers, i.e. arm64 and mips.
Address of function/instruction to instrument.
OptionalwriteCallback that emits a custom redirect from the instrumented function or instruction to Interceptor's trampoline.
The primary use-case is defeating fingerprinting: emitting a redirect that a RASP implementation won't recognize as an inline hook. It is also useful when space is tight and you want to locate a nearby code cave reachable through a short immediate branch, and then branch from there to the trampoline farther away.
Throwing from the callback declines the redirect. There is no fallback to
the default strategy in that case: the attach() / replace() /
replaceFast() call fails as if the target had a signature that could
not be instrumented.
Target to instrument, carrying the address alongside optional knobs that control how the inline hook is set up.