Cross-platform hooking engine, memory introspection framework, and security research primitives.

BypassCore SDK is the foundational library powering the entire BypassCore toolchain. It provides battle-tested, low-level primitives for:

• Function hooking (inline detours, IAT patching, VMT swapping, syscall interception)
• Memory introspection (region enumeration, pattern scanning, page protection manipulation)
• Process interaction (read/write memory, module enumeration, thread control, privilege management)
• Binary analysis (PE parsing, instruction length disassembly, relocation processing)

Designed for security researchers, reverse engineers, and tool developers who need reliable, well-documented building blocks.

+-------------------------------------------------------------------+
|                        BypassCore SDK                              |
|-------------------------------------------------------------------|
|  Hook Engine          | Memory Engine       | Binary Engine       |
|  - Inline Detour      | - Region Enum       | - PE Parser         |
|  - IAT Hook           | - AOB Scanner       | - Disassembler      |
|  - VMT Hook           | - Memory Patch      | - Reloc Processing  |
|  - Syscall Hook       | - Page Protection   | - Import/Export     |
|  - Trampoline Gen     | - Code Cave Finder  |                     |
|-------------------------------------------------------------------|
|  Process Layer        | Platform Layer      | Utilities           |
|  - Process Enum       | - OS Detection      | - Result<T,E>       |
|  - Module Mgmt        | - Arch Detection    | - Logger            |
|  - Thread Control     | - NT API Resolver   | - Scope Guard       |
|  - Token/Privilege    |                     | - FNV-1a Hash       |
+-------------------------------------------------------------------+

git clone https://github.com/bypasscore/bypasscore-sdk.git
cd bypasscore-sdk
cmake -B build -DBYPASSCORE_BUILD_TESTS=ON -DBYPASSCORE_BUILD_EXAMPLES=ON
cmake --build build --config Release

#include "bypasscore/hook/detour.h"

using MessageBoxA_t = int(WINAPI*)(HWND, LPCSTR, LPCSTR, UINT);
MessageBoxA_t orig = nullptr;

int WINAPI hooked(HWND h, LPCSTR text, LPCSTR cap, UINT type) {
    printf("Intercepted: %s\n", text);
    return orig(h, "[Hooked]", cap, type);
}

bypasscore::hook::DetourHook hook;
hook.install(GetProcAddress(GetModuleHandleA("user32"), "MessageBoxA"),
             hooked, &orig);

#include "bypasscore/memory/scanner.h"

auto result = bypasscore::memory::find_pattern(
    data, size, "48 8B 05 ?? ?? ?? ?? 48 85 C0");
if (result && *result)
    printf("Found at offset: 0x%zX\n", **result);

#include "bypasscore/binary/pe.h"

auto pe = bypasscore::binary::PeImage::parse(data, size);
if (pe) {
    printf("Image base: 0x%llX\n", pe->image_base());
    for (const auto& sec : pe->sections())
        printf("  %s: 0x%X (%zu bytes)\n",
               sec.name.c_str(), sec.virtual_address, sec.virtual_size);
}

Pattern scanning benchmarks (1GB buffer, 16-byte pattern):

Hooking overhead per call:

cd bindings/python
pip install pybind11
python setup.py build_ext --inplace

import pybypasscore as bc

bc.initialize()
print(bc.get_os_version())
print(bc.fnv1a_32("CreateFileW"))

offset = bc.scan_buffer(data, "48 8B 05 ?? ?? ?? ??")
procs = bc.enumerate_processes()

• bc_dump - PE header dump utility
• bc_scan - Standalone file pattern scanner

This SDK draws from extensive research in the security community:

• Microsoft PE/COFF Specification
• Intel x86/x64 Software Developer Manuals
• ARM Architecture Reference Manual
• Windows Internals (Russinovich et al.)
• Detours: Binary Interception of Win32 Functions (Hunt & Brubacher, 1999)

This SDK is intended for authorized security research, education, and legitimate software development only. By using this software, you agree to:

• Only test on systems you own or have written authorization to test
• Comply with all applicable laws and regulations in your jurisdiction
• Not use this software for malicious purposes, piracy, or unauthorized access
• Report any vulnerabilities you discover responsibly

See SECURITY.md for our security policy and vulnerability reporting process.

MIT License - see LICENSE for details.

Building on BypassCore SDK? Need commercial licensing, custom modules, or integration support?

• Email: contact@bypasscore.com
• Telegram: @bypasscore
• Web: bypasscore.com

Help keep BypassCore open-source and independent.

USDT / USDC / ETH / BNB accepted on all networks.