Add HookAnalyzer Logic by IronHammer-Std · Pull Request #20 · Phobos-developers/SyringeEx

IronHammer-Std · 2026-05-14T13:21:53Z

Context

NOTE

all the flags are temporarily stored in the SyringeDebugger class, and maybe we need to move it to another subclass.
HookAnalyzer class is moved from SyringeIH here as it was except a few translations.
HookAnalyzer::ReportNDJSON is not yet implemented until we import a JSON library,and I place the function here just as Kerbiter's wish.
some of the flags are set to default because the coupled components are not here in SyringeEx, so now every hook are set to be shown in the hook analysis.

New & Enhanced Logic :

Components (1) :
HookAnalyzer

New Flags (8) :

    bool bDryRun{ false };
    bool bGenerateINJ{ false };
    bool bReportLOG{ false };
    bool bReportJSON{ false };
    bool bDetectConflict{ false };
    bool bShowHookConflictPopup{ false };
    bool bReportLogByAddress{ true };
    bool bReportLogByLibrary{ true };

Launch Arguments (8) :

--dryrun : run syringe without launching game.
--generate-inj : generate INJ files and place them in .\INJ folder
--report-log : generate a HookAnalysis.log, as it functions in SyringeIH but in English
--no-by-address : Disable the "By Address" part in HookAnalysis.log.
--no-by-library : Disable the "By Library" part in HookAnalysis.log.
--report-json : generate a HookAnalysis.json TODO
--detect-conflict : Detect hook conflict and output to Syringe.log, as it functions in SyringeIH but in English
--show-hook-conflict-popup : Show a popup when --detect-conflict is enabled and a conflict is detected.

In the dry run mode all other 7 flags are available.

ReportJSON not yet implemented

ZivDero · 2026-05-14T13:28:25Z

Can you elaborate on what this does?
--detect-conflict seems straghtforward and useful for cross-library problems.
But it's unclear what any of the rest is.

IronHammer-Std · 2026-05-14T14:54:48Z

OK let me explain the rest flags.
the design simply copies SyringeIH and most of the design reserved.

Dry Run Mode `--dryrun`

The dry-run mode is a new one.
It came from a request of Kerbiter which simply run the analysis without starting the game
It collects hook data from DLLs, performs selected analyses, then output results and exit.

Generate INJ File `--generate-inj`

This calls GenerateINJ() to export all recognized hooks into standard INJ files (like ares.dll.inj) under the .\INJ folder.
Maybe useful for backing up hook configurations or migrating to other tools that read the INJ format.

Hook Analysis Report `--report-log`/`--no-by-address`/`--no-by-library`

Produces a HookAnalysis.log file (in English, equivalent to SyringeIH's HookAnalysis.log). By default, it includes both "By Address" and "By Library" sections. (See Phobos PR #2201, TaranDahl's SKILL.md depend on this log) You can also use --no-by-address and --no-by-library to selectively disable either section.

Hook Analysis in NDJSON ( TODO ) `--report-json`

Reserved flag for generating a HookAnalysis.json in the future NDJSON format requested by Kerbiter. Implementation is pending the integration of a JSON library.

`--detect-conflict`/`--show-hook-conflict-popup`

When --detect-conflict is active, this flag also shows a message box warning the user about any detected conflicts when enabled.

Metadorius · 2026-05-16T13:30:26Z

+bool HookAnalyzer::ReportLOG(bool ByAddr, bool ByLib)
+{
+	constexpr auto const VersionString = "SyringeEx " SYRINGEEX_VER_TEXT ", based on Syringe 0.7.2.0";
+
+	FileHandle File = FileHandle(fopen("HookAnalysis.log", "w"));
+	if (!File)return false;
+	fprintf(File, "%s will analyze the specified hooks.\n", VersionString);
+	if (ByAddr)
+	{
+		fputs("========================\n", File);
+		fputs("By Hook Position: （Execution order for each address）\n", File);
+		for (auto& p : ByAddress)
+		{
+			fprintf(File, "At %08X : \n", p.first);
+			for (auto v : p.second)
+			{
+				//fprintf(File, "Hook\"%s, Relative to\"%s\", From\"%s\", %d Bytes Overridden ,Priority %d, Sub Priority \"%s\"\n", v.Proc.c_str(), v.RelLib.c_str(), v.Lib.c_str(), v.Len, v.Priority, v.SubPriority.c_str());
+				fprintf(File, "Hook\"%s, From\"%s\", %d Bytes Overridden\n", v.Proc.c_str(), v.Lib.c_str(), v.Len);
+			}
+		}
+	}
+
+	if (ByLib)
+	{
+		fputs("========================\n", File);
+		fputs("By Hook Source: \n", File);
+		for (auto& p : ByLibName)
+		{
+			fprintf(File, "Analyzing DLL : \"%s\" ……\n", p.first.c_str());
+			for (auto v : p.second)
+			{
+				//fprintf(File, "Hook\"%s, Relative to\"%s\", From\"%s\", %d Bytes Overridden ,Priority %d, Sub Priority \"%s\"\n", v.Proc.c_str(), v.RelLib.c_str(), v.Lib.c_str(), v.Len, v.Priority, v.SubPriority.c_str());
+				fprintf(File, "Hook\"%s, From\"%s\", %d Bytes Overridden\n", v.Proc.c_str(), v.Lib.c_str(), v.Len);
+			}
+		}
+	}
+
+	fputs("========================\n", File);
+	fprintf(File, "%s : Complete.\n", VersionString);
+	return true;
+}


why do we need to write this in a separate log other than syringe.log?

Metadorius · 2026-05-16T13:31:52Z

+bool HookAnalyzer::GenerateINJ()
+{
+	//Log::WriteLine(ExecutableDirectoryPath().c_str());
+	auto path = ExecutableDirectoryPath() + "\\INJ";
+	auto pp = CreateDirectoryA(path.c_str(), NULL);
+	if (pp || GetLastError() == ERROR_ALREADY_EXISTS)
+	{
+		//Log::WriteLine((path + "\\").c_str());
+		for (auto& p : ByLibNameEx)
+		{
+			//Log::WriteLine((path + "\\" + p.first).c_str());
+			FileHandle File = FileHandle(fopen((path + "\\" + p.first + ".inj").c_str(), "w"));
+			if (!File)return false;
+			for (auto& h : p.second)
+			{
+				if (!h.RelLib.empty())
+					fputs(";Relative Hook Found ,failed to Generate", File);
+				else if (!h.SubPriority.empty())
+					fprintf(File, "%X=%s,%X,%d,%s\n", h.Addr, h.Proc.c_str(), h.Len, h.Priority, h.SubPriority.c_str());
+				else if (h.Priority == DefaultPriority)
+					fprintf(File, "%X=%s,%X\n", h.Addr, h.Proc.c_str(), h.Len);
+				else
+					fprintf(File, "%X=%s,%X,%d\n", h.Addr, h.Proc.c_str(), h.Len, h.Priority);
+			}
+		}
+		return true;
+	}
+	return false;
+}


what's the INJ generation for? is there some other tool that uses INJ files, or what's the premise for it?

Metadorius · 2026-05-16T13:35:53Z

+    static constexpr std::string_view GENERATEINJ_FLAG = "--generate-inj";
+    static constexpr std::string_view REPORT_LOG_FLAG = "--report-log";
+    static constexpr std::string_view REPORT_JSON_FLAG = "--report-json";
+    static constexpr std::string_view DETECT_CONFLICT_FLAG = "--detect-conflict";


is it a slow operation? is there a reason to make it optional?

I would expect the conflict detection to be always on and outputting to syringe.log

Metadorius · 2026-05-16T13:41:52Z

+bool HookAnalyzer::ReportLOG(bool ByAddr, bool ByLib)
+{
+	constexpr auto const VersionString = "SyringeEx " SYRINGEEX_VER_TEXT ", based on Syringe 0.7.2.0";
+
+	FileHandle File = FileHandle(fopen("HookAnalysis.log", "w"));
+	if (!File)return false;
+	fprintf(File, "%s will analyze the specified hooks.\n", VersionString);
+	if (ByAddr)
+	{
+		fputs("========================\n", File);
+		fputs("By Hook Position: （Execution order for each address）\n", File);
+		for (auto& p : ByAddress)
+		{
+			fprintf(File, "At %08X : \n", p.first);
+			for (auto v : p.second)
+			{
+				//fprintf(File, "Hook\"%s, Relative to\"%s\", From\"%s\", %d Bytes Overridden ,Priority %d, Sub Priority \"%s\"\n", v.Proc.c_str(), v.RelLib.c_str(), v.Lib.c_str(), v.Len, v.Priority, v.SubPriority.c_str());
+				fprintf(File, "Hook\"%s, From\"%s\", %d Bytes Overridden\n", v.Proc.c_str(), v.Lib.c_str(), v.Len);
+			}
+		}
+	}
+
+	if (ByLib)
+	{
+		fputs("========================\n", File);
+		fputs("By Hook Source: \n", File);
+		for (auto& p : ByLibName)
+		{
+			fprintf(File, "Analyzing DLL : \"%s\" ……\n", p.first.c_str());
+			for (auto v : p.second)
+			{
+				//fprintf(File, "Hook\"%s, Relative to\"%s\", From\"%s\", %d Bytes Overridden ,Priority %d, Sub Priority \"%s\"\n", v.Proc.c_str(), v.RelLib.c_str(), v.Lib.c_str(), v.Len, v.Priority, v.SubPriority.c_str());
+				fprintf(File, "Hook\"%s, From\"%s\", %d Bytes Overridden\n", v.Proc.c_str(), v.Lib.c_str(), v.Len);
+			}
+		}
+	}
+
+	fputs("========================\n", File);
+	fprintf(File, "%s : Complete.\n", VersionString);
+	return true;
+}


does this output all hooks or only conflicts? I would expect only conflicts to be outputted, and I feel like they should always be sorted by address? not sure how the by DLL one functions, since the conflicts can (and will) be cross-dll. do we even need any sorting modes?

OK let me explain :

Sorry to say that I did not redesign the hook analysis module so there might be something that didnt meet your expectations.
If you think these changes are needed, I will make a new commit for it.
Another thing is that what JSON library should we import ?
the NDJSON format output won't be there until a JSON library is chosen.

Details :

1.

why do we need to write this in a separate log other than syringe.log?

of course we can if you think this is necessary. If you want a why, it is just as it was.
If you think it should be in Syringe.log, we can change the target.

2.

what's the INJ generation for? is there some other tool that uses INJ files, or what's the premise for it?
For there was a INJ generation function.
If you think this is meaningless, a removal will be considered.

3.

is it a slow operation? is there a reason to make it optional?

I would expect the conflict detection to be always on and outputting to syringe.log

I'm sorry to say that again but it is optional because it was optional.
It's OK to let it enabled all the time.

4.

does this output all hooks or only conflicts? I would expect only conflicts to be outputted, and I feel like they should always be sorted by address? not sure how the by DLL one functions, since the conflicts can (and will) be cross-dll. do we even need any sorting modes?

this ReportLOG function is not the thing that detects conflicts.
there should be flags to control the range that ReportLOG outputs, however it isn't here.
" by DLL "just output these hooks DLL after DLL.
Sorting modes are not currently configurable.

about --report-log :
Another thing is that TaranDahl's SKILL.md still depends on the HookAnalysis.log now and we need the adjusted logic functions similarly when rewritting it.
It enumerates hooks in the configured range. (still cannot configure it in this PR)
(an output format or output target change is OK)

about --detect-conflict :
Now the result is written in Syringe.log.
also you can change it's format and target.
It detects all cross-dll hook conflicts.

No need to be sorry, it's alright.

On 1 and 3 let's do it then (though I wonder if having it always on will impact startup time a lot, have you checked it?);

on 2: I mean I don't mind it in principle, I just wonder what's the specific use case?

on 4, sorry, I didn't understand what you mean. I was asking about the ByAddr and ByLib function, and I was also wondering whether the output is only conflicts or something else too.

let --detect-conflict always on .. it seems that there may be a few milliseconds and I need a further benchmark.
Most of the time is used to sort the hooks( see std::sort in the function)
And I will try and give the result.

On 2 : Currently there is no active use case but it was used before though. Besides, it's just another way to output all the hooks in a more familiar format.

On 4 : ByAddr and ByLib not only output the conflicts. They are independent of conflict detection.
In this PR, they just output all the hooks sorted by addresses and libraries respectively.
for these two arguments , they affects the behavior of --report-log flag.
ByAddr and ByLib should be enabled for various ranges but I haven't implemented these ranges in this repo because the config component is not here.

IronHammer-Std · 2026-05-17T12:31:24Z

I just try to measure the time cost of function HookAnalyzer::HasHookConflict.

Status Log:

[19:54:31] SyringeDebugger::FindDLLs: Recognized DLL: "Ares.dll"
[19:54:31] SyringeDebugger::Handshake: Skipping handshake for DLL: "Ares.dll"
[19:54:31] SyringeDebugger::FindDLLs: Recognized DLL: "d3d9.dll"
[19:54:31] SyringeDebugger::Handshake: Skipping handshake for DLL: "d3d9.dll"
[19:54:31] SyringeDebugger::FindDLLs: Recognized DLL: "IHCore.dll"
[19:54:31] SyringeDebugger::Handshake: Skipping handshake for DLL: "IHCore.dll"
[19:54:31] SyringeDebugger::FindDLLs: Recognized DLL: "Phobos.dll"
[19:54:31] SyringeDebugger::Handshake: Skipping handshake for DLL: "Phobos.dll"
[19:54:31] SyringeDebugger::FindDLLs: Recognized DLL: "SIWinterIsComing_LTS#196_0.dll"
[19:54:31] SyringeDebugger::Handshake: Skipping handshake for DLL: "SIWinterIsComing_LTS#196_0.dll"
[19:54:31] SyringeDebugger::FindDLLs: Done (4136 hooks added).

Conflicts detected:

[19:54:31] Hook Conflict Detected:
[19:54:31] Hook"INIClass_Parse_IniSectionIncludes_CopySection2", At 0x00525E44, From"Ares.dll", 7 Bytes Overridden

[19:54:31] Hook"IniSectionIncludes_CopySection1", At 0x00525E47, From"d3d9.dll", 6 Bytes Overridden

[19:54:31] Hook Conflict Detected:
[19:54:31] Hook"_LoadRA2MD", At 0x006BC0CC, From"d3d9.dll", 6 Bytes Overridden

[19:54:31] Hook"LoadRA2MD", At 0x006BC0CD, From"Ares.dll", 5 Bytes Overridden

[19:54:31] Hook"ECInitialize", At 0x006BC0CD, From"IHCore.dll", 5 Bytes Overridden

[19:54:31] Hook Conflict Detected:
[19:54:31] Hook"TacticalClass_DrawRadialIndicators_WeaponRange", At 0x006DBE63, From"Phobos.dll", 6 Bytes Overridden

[19:54:31] Hook"SITacticalClass_DrawRadialIndicators_WeaponRange_2", At 0x006DBE68, From"SIWinterIsComing_LTS#196_0.dll", 7 Bytes Overridden

[19:54:31] Hook Conflict Detected:
[19:54:31] Hook"TacticalClass_DrawRadialIndicators_WeaponRange", At 0x006DC18E, From"Phobos.dll", 6 Bytes Overridden

[19:54:31] Hook"SITacticalClass_DrawRadialIndicators_WeaponRange_1", At 0x006DC193, From"SIWinterIsComing_LTS#196_0.dll", 7 Bytes Overridden

[19:54:31] Hook Conflict Detected:
[19:54:31] Hook"TechnoClass_EvalThreatRating", At 0x0070CF45, From"Ares.dll", 11 Bytes Overridden

[19:54:31] Hook"Verses_fmul_2", At 0x0070CF49, From"d3d9.dll", 7 Bytes Overridden

Time (in nanoseconds) :
Count : 1000
Average : 587976.8
Maximum : 2477700
Minimum : 406800
StandardDeviation: 182907.5
Median: 549400
P99: 949500

We can consider that the time cost is no more than 1 millisecond.

IronHammer-Std · 2026-05-17T12:44:23Z

OK 1 and 3 complete.
Now hook analysis result will output to Syringe.log rather than HookAnalysis.log
And hook conflict detection is always on, the flag --detect-conflict is removed

If there is no separate log, I think we should act quicker for a NDJSON format.

IronHammer-Std added 5 commits May 14, 2026 11:48

Disable Warning C4456 for a certain part of code

e4d32f5

Basic Hook Analyzer with INJ generation

5475e50

Set DefaultPriority

7d14054

Temp show all hooks in HookAnalysis (until rule sets implemented)

bf6668e

ReportLOG & DetectConflict

f677f56

ReportJSON not yet implemented

fix a return of HookAnalyzer::HasHookConflict

d254215

Metadorius reviewed May 16, 2026

View reviewed changes

Fix --detect-conflict format

154c7e5

IronHammer-Std added 2 commits May 17, 2026 20:33

Always detect hook conflicts.

930c208

Merge Hook Analysis into Syringe.log

127e575

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add HookAnalyzer Logic#20

Add HookAnalyzer Logic#20
IronHammer-Std wants to merge 9 commits into
Phobos-developers:masterfrom
IronHammer-Std:master

IronHammer-Std commented May 14, 2026

Uh oh!

ZivDero commented May 14, 2026

Uh oh!

IronHammer-Std commented May 14, 2026

Uh oh!

Metadorius May 16, 2026

Uh oh!

Metadorius May 16, 2026

Uh oh!

Metadorius May 16, 2026

Uh oh!

Metadorius May 16, 2026

Uh oh!

IronHammer-Std May 16, 2026

Uh oh!

IronHammer-Std May 16, 2026 •

edited

Loading

Uh oh!

Metadorius May 16, 2026

Uh oh!

IronHammer-Std May 17, 2026

Uh oh!

IronHammer-Std commented May 17, 2026

Uh oh!

IronHammer-Std commented May 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

IronHammer-Std commented May 14, 2026

Context

NOTE

New & Enhanced Logic :

New Flags (8) :

Launch Arguments (8) :

Uh oh!

ZivDero commented May 14, 2026

Uh oh!

IronHammer-Std commented May 14, 2026

Dry Run Mode --dryrun

Generate INJ File --generate-inj

Hook Analysis Report --report-log/--no-by-address/--no-by-library

Hook Analysis in NDJSON ( TODO ) --report-json

--detect-conflict/--show-hook-conflict-popup

Uh oh!

Metadorius May 16, 2026

Choose a reason for hiding this comment

Uh oh!

Metadorius May 16, 2026

Choose a reason for hiding this comment

Uh oh!

Metadorius May 16, 2026

Choose a reason for hiding this comment

Uh oh!

Metadorius May 16, 2026

Choose a reason for hiding this comment

Uh oh!

IronHammer-Std May 16, 2026

Choose a reason for hiding this comment

1.

2.

3.

4.

Uh oh!

IronHammer-Std May 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Metadorius May 16, 2026

Choose a reason for hiding this comment

Uh oh!

IronHammer-Std May 17, 2026

Choose a reason for hiding this comment

Uh oh!

IronHammer-Std commented May 17, 2026

Uh oh!

IronHammer-Std commented May 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Dry Run Mode `--dryrun`

Generate INJ File `--generate-inj`

Hook Analysis Report `--report-log`/`--no-by-address`/`--no-by-library`

Hook Analysis in NDJSON ( TODO ) `--report-json`

`--detect-conflict`/`--show-hook-conflict-popup`

IronHammer-Std May 16, 2026 •

edited

Loading