GCC Code Coverage Report

Directory: ./
Coverage: low: ≥ 0% medium: ≥ 75.0% high: ≥ 90.0%
Coverage Exec / Excl / Total
Lines: 74.6% 759 / 0 / 1017
Functions: 96.6% 57 / 0 / 59
Branches: 32.6% 748 / 0 / 2293
src/hook_manager.cpp
Line Branch Exec Source
1 #include "DetourModKit/hook_manager.hpp"
2 #include "DetourModKit/diagnostics.hpp"
3 #include "DetourModKit/format.hpp"
4 #include "DetourModKit/memory.hpp"
5 #include "platform.hpp"
6 #include "scanner_internal.hpp"
7 #include "x86_decode.hpp"
8
9 #include <windows.h>
10
11 #include <algorithm>
12 #include <array>
13 #include <cstddef>
14 #include <cstdint>
15 #include <format>
16 #include <memory>
17 #include <new>
18 #include <optional>
19 #include <vector>
20
21 namespace DetourModKit
22 {
23 using DetourModKit::Scanner::parse_aob;
24
25 namespace
26 {
27 // Maps a HookManager hook type onto the diagnostic event bus's hook flavor.
28 844 [[nodiscard]] Diagnostics::HookKind to_diagnostics_hook_kind(HookType type) noexcept
29 {
30
2/4
✓ Branch 2 → 3 taken 834 times.
✓ Branch 2 → 4 taken 10 times.
✗ Branch 2 → 5 not taken.
✗ Branch 2 → 6 not taken.
 844 switch (type)
31 {
32 834 case HookType::Inline:
33 834 return Diagnostics::HookKind::Inline;
34 10 case HookType::Mid:
35 10 return Diagnostics::HookKind::Mid;
36 ✗ case HookType::Vmt:
37 ✗ return Diagnostics::HookKind::Vmt;
38 }
39 ✗ return Diagnostics::HookKind::Inline;
40 }
41
42 // Publishes a hook lifecycle transition on the process-wide diagnostic bus. Called only from the post-lock tail
43 // of a HookManager mutator, after the registry locks are released, so a subscriber's handler never runs inside
44 // the registry critical section. The dispatcher is lazy and can allocate on first use, so the whole diagnostic
45 // side path is best-effort.
46 294 void emit_hook_lifecycle(std::string_view name, Diagnostics::HookKind kind,
47 Diagnostics::HookTransition transition) noexcept
48 {
49 try
50 {
51
1/2
✓ Branch 2 → 3 taken 294 times.
✗ Branch 2 → 6 not taken.
 294 Diagnostics::hook_lifecycle().emit_safe(
52 294 Diagnostics::HookLifecycleEvent{.name = name, .kind = kind, .transition = transition});
53 }
54 ✗ catch (...)
55 {
56 ✗ }
57 294 }
58
59 enum class PrehookState
60 {
61 NotHooked,
62 HookedBySameModule,
63 HookedByOtherModule
64 };
65
66 struct PrehookDetection
67 {
68 PrehookState state{PrehookState::NotHooked};
69 std::uintptr_t jmp_destination{0};
70 };
71
72 121 std::optional<std::uintptr_t> decode_prehook_destination(std::uintptr_t target_address) noexcept
73 {
74 // Read the opcode bytes under a fault guard and dispatch on the copy;
75 // an unguarded dereference of target_address could fault if the page is unmapped or guarded.
76 121 std::array<std::uint8_t, 2> opcode{};
77
1/2
✗ Branch 7 → 8 not taken.
✓ Branch 7 → 9 taken 121 times.
 242 if (!Memory::seh_read_bytes(target_address, opcode.data(), opcode.size()))
78 {
79 ✗ return std::nullopt;
80 }
81
82 // Only E9 (jmp rel32) and FF 25 (jmp [rip+disp32]) can redirect a prologue into a hook trampoline in
83 // another module. EB (jmp rel8) reaches at most +/-127 bytes, far too short to land in a foreign hook stub,
84 // so a leading 0xEB is ordinary code, not a pre-existing inline hook. Matching it here would only add false
85 // positives on functions that legitimately begin with a short jump.
86
1/2
✗ Branch 10 → 11 not taken.
✓ Branch 10 → 12 taken 121 times.
 121 if (opcode[0] == 0xE9)
87 {
88 ✗ return detail::decode_e9_rel32(target_address);
89 }
90
91
2/6
✗ Branch 13 → 14 not taken.
✓ Branch 13 → 17 taken 121 times.
✗ Branch 15 → 16 not taken.
✗ Branch 15 → 17 not taken.
✗ Branch 18 → 19 not taken.
✓ Branch 18 → 20 taken 121 times.
 121 if (opcode[0] == 0xFF && opcode[1] == 0x25)
92 {
93 ✗ return detail::decode_ff25_indirect(target_address);
94 }
95
96 121 return std::nullopt;
97 }
98
99 121 PrehookDetection detect_existing_inline_hook(std::uintptr_t target_address) noexcept
100 {
101 121 PrehookDetection result;
102
1/2
✗ Branch 2 → 3 not taken.
✓ Branch 2 → 4 taken 121 times.
 121 if (target_address == 0)
103 {
104 ✗ return result;
105 }
106
107 121 const auto destination_opt = decode_prehook_destination(target_address);
108
1/2
✓ Branch 6 → 7 taken 121 times.
✗ Branch 6 → 8 not taken.
 121 if (!destination_opt)
109 {
110 121 return result;
111 }
112 ✗ const auto destination = *destination_opt;
113 ✗ result.jmp_destination = destination;
114
115 ✗ HMODULE target_module = nullptr;
116 ✗ HMODULE dest_module = nullptr;
117 ✗ if (!GetModuleHandleExW(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS |
118 GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT,
119 reinterpret_cast<LPCWSTR>(target_address), &target_module))
120 {
121 ✗ target_module = nullptr;
122 }
123 ✗ if (!GetModuleHandleExW(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS |
124 GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT,
125 reinterpret_cast<LPCWSTR>(destination), &dest_module))
126 {
127 ✗ dest_module = nullptr;
128 }
129
130 ✗ if (dest_module != nullptr && target_module == dest_module)
131 {
132 ✗ result.state = PrehookState::HookedBySameModule;
133 }
134 else
135 {
136 ✗ result.state = PrehookState::HookedByOtherModule;
137 }
138 ✗ return result;
139 }
140
141 enum class PrologueRisk
142 {
143 None,
144 LeadingCall, // 0xE8 call rel32
145 Breakpoint // 0xCC int3 / 0xCD int n
146 };
147
148 // Classifies the first opcode byte of an inline/mid hook target. A leading E8 (call rel32) means the prologue
149 // is a relative call whose displacement is computed from the original site; SafetyHook relocates the stolen
150 // prologue into a trampoline at a different address, so the relocated call can dispatch to the wrong absolute
151 // target. A leading 0xCC (int3) or 0xCD (int n) means the entry is already a breakpoint -- a foreign hook's
152 // stub, a patched slot, or alignment padding -- not a real function body. The E9 / FF 25 redirect shapes are
153 // owned separately by detect_existing_inline_hook, and EB rel8 is ordinary short-jump code; this classifier
154 // intentionally flags only the call and breakpoint shapes. The read is SEH-guarded so an unmapped or guarded
155 // page yields None rather than faulting the host (the actual install still goes through SafetyHook, which
156 // validates separately).
157 124 PrologueRisk classify_prologue_risk(std::uintptr_t target_address) noexcept
158 {
159
1/2
✗ Branch 2 → 3 not taken.
✓ Branch 2 → 4 taken 124 times.
 124 if (target_address == 0)
160 {
161 ✗ return PrologueRisk::None;
162 }
163 124 std::uint8_t first_byte = 0;
164
1/2
✗ Branch 5 → 6 not taken.
✓ Branch 5 → 7 taken 124 times.
 124 if (!Memory::seh_read_bytes(target_address, &first_byte, sizeof(first_byte)))
165 {
166 // Unreadable target: leave the existing create-path validation and SafetyHook create to fail; do not
167 // invent a prologue warning from a read that did not happen.
168 ✗ return PrologueRisk::None;
169 }
170
3/3
✓ Branch 7 → 8 taken 2 times.
✓ Branch 7 → 9 taken 2 times.
✓ Branch 7 → 10 taken 120 times.
 124 switch (first_byte)
171 {
172 2 case 0xE8:
173 2 return PrologueRisk::LeadingCall;
174 2 case 0xCC:
175 case 0xCD:
176 2 return PrologueRisk::Breakpoint;
177 120 default:
178 120 return PrologueRisk::None;
179 }
180 }
181
182 // Human-readable fragment describing a flagged prologue risk for the deferred log lines.
183 4 [[nodiscard]] std::string_view prologue_risk_description(PrologueRisk risk) noexcept
184 {
185
2/4
✓ Branch 2 → 3 taken 2 times.
✓ Branch 2 → 4 taken 2 times.
✗ Branch 2 → 5 not taken.
✗ Branch 2 → 6 not taken.
 4 switch (risk)
186 {
187 2 case PrologueRisk::LeadingCall:
188 2 return "a call (E8)";
189 2 case PrologueRisk::Breakpoint:
190 2 return "a breakpoint (0xCC/0xCD)";
191 ✗ case PrologueRisk::None:
192 ✗ return "an unremarkable byte";
193 }
194 ✗ return "an unremarkable byte";
195 }
196 } // anonymous namespace
197
198 294 HookManager &HookManager::get_instance()
199 {
200
5/10
✓ Branch 2 → 3 taken 208 times.
✓ Branch 2 → 9 taken 86 times.
✓ Branch 4 → 5 taken 208 times.
✗ Branch 4 → 9 not taken.
✓ Branch 5 → 6 taken 208 times.
✗ Branch 5 → 11 not taken.
✓ Branch 6 → 7 taken 208 times.
✗ Branch 6 → 11 not taken.
✗ Branch 11 → 12 not taken.
✗ Branch 11 → 13 not taken.
 294 static HookManager instance;
201 294 return instance;
202 }
203
204 208 HookManager::HookManager(Logger &logger) : m_logger(logger)
205 {
206
1/2
✓ Branch 10 → 11 taken 208 times.
✗ Branch 10 → 21 not taken.
 208 m_allocator = safetyhook::Allocator::global();
207
1/2
✗ Branch 14 → 15 not taken.
✓ Branch 14 → 17 taken 208 times.
 208 if (!m_allocator)
208 {
209 ✗ m_logger.error("HookManager: Failed to get SafetyHook global allocator! Hook creation will fail.");
210 }
211 else
212 {
213
1/2
✓ Branch 17 → 18 taken 208 times.
✗ Branch 17 → 23 not taken.
 208 m_logger.debug("HookManager: SafetyHook global allocator obtained.");
214 }
215
1/2
✓ Branch 19 → 20 taken 208 times.
✗ Branch 19 → 24 not taken.
 208 m_logger.debug("HookManager: Initialized.");
216 208 }
217
218 416 HookManager::~HookManager() noexcept
219 {
220
1/2
✗ Branch 3 → 4 not taken.
✓ Branch 3 → 5 taken 208 times.
 208 if (m_shutdown_called.load(std::memory_order_acquire))
221 {
222 ✗ return;
223 }
224
225 // Fallback teardown path. Reached only when the process did not call
226 // DMK_Shutdown() / HookManager::shutdown() before static destruction (abnormal exit, FreeLibrary race, host
227 // crash).
228 //
229 // Ordering (matches the shutdown() contract so readers see one story):
230 // 1. Flip m_shutdown_called under m_mutator_gate (exclusive) to
231 // block new mutators and serialize with a late shutdown() call.
232 // 2. Disable all hooks under shared m_hooks_mutex. SafetyHook::disable()
233 // restores the original bytes; while it rewrites them it strips
234 // execute on the patched page, and a vectored exception handler
235 // relocates the instruction pointer of any thread that faults in the
236 // bytes being rewritten (it does NOT suspend threads, and does NOT
237 // drain a thread already in the detour or trampoline body). The shared
238 // lock just lets the kit's own with_* readers coexist with the disable.
239 // 3. Acquire exclusive m_hooks_mutex to wait out any shared_lock
240 // holder still inside a with_* callback. Only then clear the
241 // maps -- destroying the Hook objects would UAF a live reader.
242 //
243 // Loader-lock fallback: if the destructor is fired with the OS loader lock held (e.g. during abnormal DLL
244 // unload), acquiring m_mutator_gate or blocking readers can deadlock against another thread waiting on a loader
245 // callback. Leak the maps in that case; the pinned module keeps the hooks' code pages live so SafetyHook
246 // trampolines do not dangle. Mirrors the pattern used in Logger::shutdown_internal().
247
1/2
✗ Branch 6 → 7 not taken.
✓ Branch 6 → 31 taken 208 times.
 208 if (detail::is_loader_lock_held())
248 {
249 ✗ detail::pin_current_module();
250 // Intentional leak under loader lock: draining readers or destroying
251 // Hook / VmtHookEntry values here can deadlock against another thread waiting on a loader callback. The
252 // pinned module keeps the SafetyHook trampoline pages live for the remainder of the process, so the leaked
253 // maps and their contents stay valid storage even though no one will ever observe them again. HookManager
254 // is a singleton so this branch runs at most once per process.
255 //
256 // Heap-allocate each map directly rather than nesting them inside an outer container. A container of
257 // containers would force the standard library to instantiate a copy-construction fallback for the element
258 // type whenever the element's move constructor is not unconditionally noexcept, and that copy path would
259 // try to copy a move-only member (VmtHookEntry owns a safetyhook::VmtHook).
260 //
261 // Default-construct each map on the heap, then swap content in. std::unordered_map's move constructor is
262 // not guaranteed noexcept on every standard library implementation (some mark it noexcept(false) so
263 // allocator-propagation fallbacks can allocate); invoking it from a noexcept destructor would risk
264 // std::terminate on an unexpected allocator fallback. With a default std::allocator (stateless,
265 // is_always_equal) and noexcept hasher / comparator, member swap() is specified noexcept and performs an
266 // O(1) pointer swap that allocates nothing, so it is safe to call from a noexcept context. On allocation
267 // failure the new (std::nothrow) expression returns nullptr, the source maps keep their contents, and
268 // control falls through to the normal ~HookManager member destruction epilogue. That epilogue is
269 // best-effort under loader lock, but the pinned module still keeps trampoline code pages live so straggler
270 // trampoline calls land on valid memory.
271 ✗ auto *leaked_hooks = new (std::nothrow) detail::HookMap();
272 ✗ auto *leaked_vmt_hooks = new (std::nothrow) detail::VmtHookMap();
273 ✗ if (leaked_hooks != nullptr)
274 {
275 ✗ leaked_hooks->swap(m_hooks);
276 }
277 ✗ if (leaked_vmt_hooks != nullptr)
278 {
279 ✗ leaked_vmt_hooks->swap(m_vmt_hooks);
280 }
281 // Surface this loader-lock leak so consumers can observe teardown escape-hatch activity without parsing
282 // logs.
283 ✗ DetourModKit::Diagnostics::record_intentional_leak(DetourModKit::Diagnostics::LeakSubsystem::HookManager);
284 ✗ m_shutdown_called.store(true, std::memory_order_release);
285 ✗ return;
286 }
287
288 208 std::unique_lock<detail::SrwSharedMutex> mutator_gate(m_mutator_gate);
289 208 m_shutdown_called.store(true, std::memory_order_release);
290
291 {
292 208 std::shared_lock<detail::SrwSharedMutex> shared(m_hooks_mutex);
293 208 disable_hooks_reverse_order_locked();
294 208 }
295
296 208 std::unique_lock<detail::SrwSharedMutex> lock(m_hooks_mutex);
297 208 clear_vmt_hooks_locked();
298 208 clear_hooks_locked();
299
5/10
✓ Branch 44 → 45 taken 208 times.
✗ Branch 44 → 46 not taken.
✓ Branch 48 → 49 taken 208 times.
✗ Branch 48 → 50 not taken.
✓ Branch 52 → 53 taken 208 times.
✗ Branch 52 → 54 not taken.
✓ Branch 56 → 57 taken 208 times.
✗ Branch 56 → 58 not taken.
✓ Branch 60 → 61 taken 208 times.
✗ Branch 60 → 62 not taken.
 208 }
300
301 50 void HookManager::shutdown() noexcept
302 {
303
2/2
✓ Branch 3 → 4 taken 1 time.
✓ Branch 3 → 6 taken 49 times.
 50 if (get_reentrancy_guard() > 0)
304 {
305 // shutdown() is noexcept; route the misuse diagnostic through the no-throw try_log so a sink or format
306 // failure cannot escape the rejected reentrant call.
307 1 (void)m_logger.try_log(LogLevel::Warning,
308 "HookManager: Reentrant shutdown() from within a with_*/try_with_* callback "
309 "rejected; defer hook teardown until the callback returns.");
310 1 return;
311 }
312
313 // Serialize with remove_all_hooks() via compare_exchange_strong. Only one teardown owner proceeds.
314 49 bool expected = false;
315
1/2
✗ Branch 7 → 8 not taken.
✓ Branch 7 → 9 taken 49 times.
 49 if (!m_shutdown_called.compare_exchange_strong(expected, true, std::memory_order_acq_rel))
316 ✗ return;
317
318 // Block all mutators (create_*_hook, enable, disable, remove) before entering phase 1. They hold shared on
319 // m_mutator_gate, so acquiring exclusive here waits for active mutators and blocks new ones.
320 49 std::unique_lock<detail::SrwSharedMutex> mutator_gate(m_mutator_gate);
321
322 // Two-phase shutdown: disable hooks under a shared lock first, then clear the maps under the exclusive lock.
323 // The shared phase lets the kit's own with_* readers (shared_lock holders) finish; SafetyHook::disable()
324 // relocates only threads caught in the patched prologue and does not drain threads already in the detour or
325 // trampoline body, so the caller must quiesce the hooked function during teardown to close the residual window.
326 {
327 49 std::shared_lock<detail::SrwSharedMutex> shared(m_hooks_mutex);
328 49 disable_hooks_reverse_order_locked();
329 49 }
330 {
331 49 std::unique_lock<detail::SrwSharedMutex> lock(m_hooks_mutex);
332 49 clear_vmt_hooks_locked();
333 49 clear_hooks_locked();
334
335 // Reset under the lock so concurrent create_*_hook calls cannot observe the flag as true (rejected) and
336 // then immediately see it as false (accepted) before the map is fully cleared.
337 //
338 // This intentionally allows reuse after shutdown (hot-reload). The exclusive lock on m_mutator_gate
339 // serializes the entire clear-and-reset sequence, so there is no window where a concurrent create_*_hook
340 // can slip through against a half-cleared map. The mutator_gate exclusive lock is released here, allowing
341 // new mutators to proceed with a fresh m_shutdown_called=false.
342 49 m_shutdown_called.store(false, std::memory_order_release);
343 49 }
344 49 }
345
346 ✗ std::string HookManager::error_to_string(const safetyhook::InlineHook::Error &err) const
347 {
348 ✗ const int type_int = static_cast<int>(err.type);
349 ✗ const auto ip_str = DetourModKit::Format::format_address(reinterpret_cast<uintptr_t>(err.ip));
350
351 ✗ switch (err.type)
352 {
353 ✗ case safetyhook::InlineHook::Error::BAD_ALLOCATION:
354 return std::format("SafetyHook InlineHook Error (Type: {}): Bad allocation (Allocator error: {})", type_int,
355 ✗ static_cast<int>(err.allocator_error));
356 ✗ case safetyhook::InlineHook::Error::FAILED_TO_DECODE_INSTRUCTION:
357 return std::format("SafetyHook InlineHook Error (Type: {}): Failed to decode instruction at address {}",
358 ✗ type_int, ip_str);
359 ✗ case safetyhook::InlineHook::Error::SHORT_JUMP_IN_TRAMPOLINE:
360 return std::format("SafetyHook InlineHook Error (Type: {}): Short jump found in trampoline at address {}",
361 ✗ type_int, ip_str);
362 ✗ case safetyhook::InlineHook::Error::IP_RELATIVE_INSTRUCTION_OUT_OF_RANGE:
363 return std::format(
364 "SafetyHook InlineHook Error (Type: {}): IP-relative instruction out of range at address {}", type_int,
365 ✗ ip_str);
366 ✗ case safetyhook::InlineHook::Error::UNSUPPORTED_INSTRUCTION_IN_TRAMPOLINE:
367 return std::format(
368 "SafetyHook InlineHook Error (Type: {}): Unsupported instruction in trampoline at address {}", type_int,
369 ✗ ip_str);
370 ✗ case safetyhook::InlineHook::Error::FAILED_TO_UNPROTECT:
371 return std::format("SafetyHook InlineHook Error (Type: {}): Failed to unprotect memory at address {}",
372 ✗ type_int, ip_str);
373 ✗ case safetyhook::InlineHook::Error::NOT_ENOUGH_SPACE:
374 return std::format(
375 "SafetyHook InlineHook Error (Type: {}): Not enough space for the hook (prologue too short) at "
376 "address {}",
377 ✗ type_int, ip_str);
378 ✗ default:
379 ✗ return std::format("SafetyHook InlineHook Error (Type: {}): Unknown error type", type_int);
380 }
381 ✗ }
382
383 ✗ std::string HookManager::error_to_string(const safetyhook::MidHook::Error &err) const
384 {
385 ✗ const int type_int = static_cast<int>(err.type);
386
387 ✗ switch (err.type)
388 {
389 ✗ case safetyhook::MidHook::Error::BAD_ALLOCATION:
390 return std::format("SafetyHook MidHook Error (Type: {}): Bad allocation (Allocator error: {})", type_int,
391 ✗ static_cast<int>(err.allocator_error));
392 ✗ case safetyhook::MidHook::Error::BAD_INLINE_HOOK:
393 return std::format("SafetyHook MidHook Error (Type: {}): Bad underlying inline hook. Details: {}", type_int,
394 ✗ error_to_string(err.inline_hook_error));
395 ✗ default:
396 ✗ return std::format("SafetyHook MidHook Error (Type: {}): Unknown error type", type_int);
397 }
398 }
399
400 std::expected<std::string, HookError>
401 110 HookManager::create_inline_hook(std::string_view name, uintptr_t target_address, void *detour_function,
402 void **original_trampoline, const HookConfig &config)
403 {
404 // Non-locking fast-fail: avoid acquiring mutator_gate when shutdown is already in progress.
405
1/2
✗ Branch 3 → 4 not taken.
✓ Branch 3 → 10 taken 110 times.
 110 if (m_shutdown_called.load(std::memory_order_acquire))
406 {
407 ✗ if (original_trampoline)
408 ✗ *original_trampoline = nullptr;
409 ✗ m_logger.error("HookManager: Shutdown in progress. Cannot create inline hook '{}'.", name);
410 ✗ return std::unexpected(HookError::ShutdownInProgress);
411 }
412 // Fail closed on a reentrant call from inside a with_*/try_with_* callback: it holds m_hooks_mutex shared, so
413 // re-acquiring this non-recursive lock here is UB / deadlock. Defer the mutation past the callback.
414
2/2
✓ Branch 11 → 12 taken 1 time.
✓ Branch 11 → 18 taken 109 times.
 110 if (get_reentrancy_guard() > 0)
415 {
416
1/2
✓ Branch 12 → 13 taken 1 time.
✗ Branch 12 → 14 not taken.
 1 if (original_trampoline)
417 1 *original_trampoline = nullptr;
418
1/2
✓ Branch 14 → 15 taken 1 time.
✗ Branch 14 → 52 not taken.
 1 m_logger.error("HookManager: Reentrant create_inline_hook('{}') from within a with_*/try_with_* callback "
419 "rejected; defer hook mutation until the callback returns.",
420 name);
421 1 return std::unexpected(HookError::ReentrantCallRejected);
422 }
423
424 109 auto [result,
425 109 deferred_logs] = [&]() -> std::pair<std::expected<std::string, HookError>, std::vector<DeferredLogEntry>>
426 {
427 109 std::shared_lock<detail::SrwSharedMutex> mutator_gate(m_mutator_gate);
428
1/2
✓ Branch 3 → 4 taken 109 times.
✗ Branch 3 → 648 not taken.
 109 std::unique_lock<detail::SrwSharedMutex> lock(m_hooks_mutex);
429
430 // Re-check after acquiring locks (double-checked pattern).
431
1/2
✗ Branch 5 → 6 not taken.
✓ Branch 5 → 20 taken 109 times.
 109 if (m_shutdown_called.load(std::memory_order_acquire))
432 {
433 ✗ return {std::unexpected(HookError::ShutdownInProgress),
434 {{std::format("HookManager: Shutdown in progress. Cannot create inline hook '{}'.", name),
435 ✗ LogLevel::Error}}};
436 }
437
1/2
✗ Branch 21 → 22 not taken.
✓ Branch 21 → 36 taken 109 times.
 109 if (!m_allocator)
438 {
439 ✗ return {std::unexpected(HookError::AllocatorNotAvailable),
440 {{std::format("HookManager: Allocator not available. Cannot create inline hook '{}'.", name),
441 ✗ LogLevel::Error}}};
442 }
443
2/2
✓ Branch 36 → 37 taken 4 times.
✓ Branch 36 → 51 taken 105 times.
 109 if (target_address == 0)
444 {
445 4 return {std::unexpected(HookError::InvalidTargetAddress),
446 {{std::format("HookManager: Target address is NULL for inline hook '{}'.", name),
447
3/6
✓ Branch 41 → 42 taken 4 times.
✗ Branch 41 → 317 not taken.
✓ Branch 46 → 47 taken 4 times.
✓ Branch 46 → 48 taken 4 times.
✗ Branch 321 → 322 not taken.
✗ Branch 321 → 323 not taken.
 12 LogLevel::Error}}};
448 }
449
2/2
✓ Branch 51 → 52 taken 2 times.
✓ Branch 51 → 66 taken 103 times.
 105 if (detour_function == nullptr)
450 {
451 2 return {std::unexpected(HookError::InvalidDetourFunction),
452 {{std::format("HookManager: Detour function is NULL for inline hook '{}'.", name),
453
3/6
✓ Branch 56 → 57 taken 2 times.
✗ Branch 56 → 337 not taken.
✓ Branch 61 → 62 taken 2 times.
✓ Branch 61 → 63 taken 2 times.
✗ Branch 341 → 342 not taken.
✗ Branch 341 → 343 not taken.
 6 LogLevel::Error}}};
454 }
455
2/2
✓ Branch 66 → 67 taken 1 time.
✓ Branch 66 → 81 taken 102 times.
 103 if (original_trampoline == nullptr)
456 {
457 1 return {std::unexpected(HookError::InvalidTrampolinePointer),
458 {{std::format("HookManager: Original trampoline pointer (output) is NULL for inline hook '{}'.",
459 name),
460
3/6
✓ Branch 71 → 72 taken 1 time.
✗ Branch 71 → 357 not taken.
✓ Branch 76 → 77 taken 1 time.
✓ Branch 76 → 78 taken 1 time.
✗ Branch 361 → 362 not taken.
✗ Branch 361 → 363 not taken.
 3 LogLevel::Error}}};
461 }
462 102 *original_trampoline = nullptr;
463
464
3/4
✓ Branch 81 → 82 taken 102 times.
✗ Branch 81 → 646 not taken.
✓ Branch 82 → 83 taken 1 time.
✓ Branch 82 → 97 taken 101 times.
 102 if (hook_id_exists_locked(name))
465 {
466 return {
467 1 std::unexpected(HookError::HookAlreadyExists),
468
3/6
✓ Branch 87 → 88 taken 1 time.
✗ Branch 87 → 377 not taken.
✓ Branch 92 → 93 taken 1 time.
✓ Branch 92 → 94 taken 1 time.
✗ Branch 381 → 382 not taken.
✗ Branch 381 → 383 not taken.
 3 {{std::format("HookManager: A hook with the name '{}' already exists.", name), LogLevel::Error}}};
469 }
470
471 // Self-registry pre-flight: does this HookManager already patch this exact address? Layering a second
472 // managed hook onto one target is the use-after-free-on-teardown hazard -- SafetyHook saves the live
473 // prologue (a jump to the first detour) as the second hook's "original" bytes, so the two must unwind
474 // newest-first or the entry is left jumping into a freed trampoline (see
475 // disable_hooks_reverse_order_locked). The registry check is exact, unlike the prologue-byte heuristic
476 // below which cannot tell our own patch from a foreign module's. Refuse under strict mode; otherwise record
477 // which managed hook is being layered on for the deferred warning.
478 101 std::string layered_on_managed_hook;
479
2/2
✓ Branch 99 → 100 taken 6 times.
✓ Branch 99 → 118 taken 95 times.
 101 if (const std::string *self_owner = find_hook_owner_of_target_locked(target_address))
480 {
481
2/2
✓ Branch 100 → 101 taken 3 times.
✓ Branch 100 → 117 taken 3 times.
 6 if (config.fail_if_already_hooked)
482 {
483 return {
484 3 std::unexpected(HookError::TargetAlreadyHookedInProcess),
485 {{std::format("HookManager: Target {} for inline hook '{}' is already hooked by managed hook "
486 "'{}'. Aborting under strict mode.",
487 ✗ DetourModKit::Format::format_address(target_address), name, *self_owner),
488
3/6
✓ Branch 106 → 107 taken 3 times.
✗ Branch 106 → 397 not taken.
✓ Branch 111 → 112 taken 3 times.
✓ Branch 111 → 113 taken 3 times.
✗ Branch 401 → 402 not taken.
✗ Branch 401 → 403 not taken.
 12 LogLevel::Error}}};
489 }
490
1/2
✓ Branch 117 → 118 taken 3 times.
✗ Branch 117 → 644 not taken.
 3 layered_on_managed_hook = *self_owner;
491 }
492
493 // Foreign-module pre-flight: only meaningful when this manager does not already own a hook here. When it
494 // does, the prologue jump is our own patch (handled above) and decoding it would misreport it as another
495 // module's.
496 98 PrehookDetection prehook;
497
2/2
✓ Branch 119 → 120 taken 95 times.
✓ Branch 119 → 141 taken 3 times.
 98 if (layered_on_managed_hook.empty())
498 {
499 95 prehook = detect_existing_inline_hook(target_address);
500
1/4
✗ Branch 121 → 122 not taken.
✓ Branch 121 → 141 taken 95 times.
✗ Branch 122 → 123 not taken.
✗ Branch 122 → 141 not taken.
 95 if (prehook.state == PrehookState::HookedByOtherModule && config.fail_if_already_hooked)
501 {
502 return {
503 ✗ std::unexpected(HookError::TargetAlreadyHookedInProcess),
504 {{std::format(
505 "HookManager: Target {} for inline hook '{}' is already inline-hooked by another module "
506 "(JMP -> {}). Aborting under strict mode.",
507 ✗ DetourModKit::Format::format_address(target_address), name,
508 ✗ DetourModKit::Format::format_address(prehook.jmp_destination)),
509 ✗ LogLevel::Error}}};
510 }
511 }
512
513 // Prologue pre-flight: a leading E8 (call rel32) or 0xCC/0xCD breakpoint at the hook site is unsafe to
514 // inline-hook (see classify_prologue_risk). Independent of the layering checks above: a target can be
515 // unhooked yet still begin with a call thunk or a patched int3. The classifier is cheap and host-safe so it
516 // always runs; only escalation is policy-gated. *original_trampoline was nulled above, so the Fail
517 // early-return leaves it null as required.
518 98 const PrologueRisk prologue_risk = classify_prologue_risk(target_address);
519
3/4
✓ Branch 142 → 143 taken 3 times.
✓ Branch 142 → 161 taken 95 times.
✓ Branch 143 → 144 taken 3 times.
✗ Branch 143 → 161 not taken.
 98 if (prologue_risk != PrologueRisk::None && config.prologue_policy == InlineProloguePolicy::Fail)
520 {
521 3 return {std::unexpected(HookError::TargetPrologueUnsafe),
522 {{std::format("HookManager: Target {} for inline hook '{}' begins with {}; refusing under Fail "
523 "prologue policy.",
524 ✗ DetourModKit::Format::format_address(target_address), name,
525 ✗ prologue_risk_description(prologue_risk)),
526
3/6
✓ Branch 150 → 151 taken 3 times.
✗ Branch 150 → 446 not taken.
✓ Branch 155 → 156 taken 3 times.
✓ Branch 155 → 157 taken 3 times.
✗ Branch 450 → 451 not taken.
✗ Branch 450 → 452 not taken.
 12 LogLevel::Error}}};
527 }
528
529 try
530 {
531 95 auto sh_flags =
532
2/2
✓ Branch 161 → 162 taken 91 times.
✓ Branch 161 → 163 taken 4 times.
 95 config.auto_enable ? safetyhook::InlineHook::Default : safetyhook::InlineHook::StartDisabled;
533
534 auto hook_creation_result = safetyhook::InlineHook::create(
535
1/2
✓ Branch 164 → 165 taken 95 times.
✗ Branch 164 → 566 not taken.
 95 m_allocator, reinterpret_cast<void *>(target_address), detour_function, sh_flags);
536
537
1/2
✗ Branch 166 → 167 not taken.
✓ Branch 166 → 186 taken 95 times.
 95 if (!hook_creation_result)
538 {
539 return {
540 ✗ std::unexpected(HookError::SafetyHookError),
541 {{std::format("HookManager: Failed to create SafetyHook::InlineHook for '{}' at {}. Error: {}",
542 ✗ name, DetourModKit::Format::format_address(target_address),
543 ✗ error_to_string(hook_creation_result.error())),
544 ✗ LogLevel::Error}}};
545 }
546
547
1/2
✓ Branch 186 → 187 taken 95 times.
✗ Branch 186 → 564 not taken.
 190 auto sh_inline_hook = std::move(hook_creation_result.value());
548 95 void *trampoline = sh_inline_hook.original<void *>();
549
550
2/2
✓ Branch 192 → 193 taken 91 times.
✓ Branch 192 → 194 taken 4 times.
 95 HookStatus initial_status = sh_inline_hook.enabled() ? HookStatus::Active : HookStatus::Disabled;
551
552 // Pre-build log entries before committing to m_hooks so that allocation failures in std::format cannot
553 // leave a ghost hook.
554
3/4
✓ Branch 197 → 198 taken 91 times.
✓ Branch 197 → 199 taken 4 times.
✓ Branch 200 → 201 taken 95 times.
✗ Branch 200 → 496 not taken.
 95 std::string status_message = (initial_status == HookStatus::Active) ? "and enabled" : "(disabled)";
555 95 std::vector<DeferredLogEntry> logs;
556
1/2
✓ Branch 202 → 203 taken 95 times.
✗ Branch 202 → 558 not taken.
 95 logs.reserve(3);
557 95 logs.push_back({std::format("HookManager: Successfully created {} inline hook '{}' targeting {}.",
558 ✗ status_message, name, DetourModKit::Format::format_address(target_address)),
559 LogLevel::Info});
560
561
2/2
✓ Branch 211 → 212 taken 3 times.
✓ Branch 211 → 220 taken 92 times.
 95 if (!layered_on_managed_hook.empty())
562 {
563 3 logs.push_back(
564 {std::format(
565 "HookManager: Target {} for inline hook '{}' is already hooked by managed hook '{}'; "
566 "SafetyHook layered on top. Remove layered hooks newest-first.",
567 3 DetourModKit::Format::format_address(target_address), name, layered_on_managed_hook),
568 LogLevel::Warning});
569 }
570
1/2
✗ Branch 220 → 221 not taken.
✓ Branch 220 → 231 taken 92 times.
 92 else if (prehook.state == PrehookState::HookedByOtherModule)
571 {
572 ✗ logs.push_back(
573 {std::format(
574 "HookManager: Target {} for inline hook '{}' was already inline-hooked by another module "
575 "(JMP -> {}); SafetyHook layered on top.",
576 ✗ DetourModKit::Format::format_address(target_address), name,
577 ✗ DetourModKit::Format::format_address(prehook.jmp_destination)),
578 LogLevel::Warning});
579 }
580
581
1/2
✗ Branch 231 → 232 not taken.
✓ Branch 231 → 241 taken 95 times.
 95 if (prologue_risk != PrologueRisk::None)
582 {
583 ✗ logs.push_back(
584 {std::format(
585 "HookManager: Target {} for inline hook '{}' begins with {}; installed anyway under "
586 "Warn prologue policy.",
587 ✗ DetourModKit::Format::format_address(target_address), name,
588 ✗ prologue_risk_description(prologue_risk)),
589 LogLevel::Warning});
590 }
591
592
3/4
✓ Branch 241 → 242 taken 4 times.
✓ Branch 241 → 249 taken 91 times.
✗ Branch 242 → 243 not taken.
✓ Branch 242 → 249 taken 4 times.
 95 if (initial_status == HookStatus::Disabled && config.auto_enable)
593 {
594 ✗ logs.push_back({std::format("HookManager: Inline hook '{}' was configured for auto-enable "
595 "but is currently disabled post-creation.",
596 name),
597 LogLevel::Warning});
598 }
599
600
1/2
✓ Branch 251 → 252 taken 95 times.
✗ Branch 251 → 550 not taken.
 285 std::string name_str{name};
601 auto managed_hook =
602
1/2
✓ Branch 255 → 256 taken 95 times.
✗ Branch 255 → 556 not taken.
 95 std::make_unique<InlineHook>(name_str, target_address, std::move(sh_inline_hook), initial_status);
603 // Record creation order before emplace: if emplace throws, the stale order entry is a harmless skip at
604 // teardown, whereas a registered hook missing from the order vector would dodge the ordered unwind.
605
1/2
✓ Branch 256 → 257 taken 95 times.
✗ Branch 256 → 554 not taken.
 95 m_hook_creation_order.push_back(name_str);
606
1/2
✓ Branch 259 → 260 taken 95 times.
✗ Branch 259 → 553 not taken.
 190 m_hooks.emplace(name_str, std::move(managed_hook));
607 95 *original_trampoline = trampoline;
608
609 190 return {std::move(name_str), std::move(logs)};
610 95 }
611 ✗ catch (const std::exception &e)
612 {
613 return {
614 ✗ std::unexpected(HookError::UnknownError),
615 {{std::format("HookManager: An std::exception occurred during inline hook creation for '{}': {}",
616 ✗ name, e.what()),
617 ✗ LogLevel::Error}}};
618 ✗ }
619 ✗ catch (...)
620 {
621 ✗ return {std::unexpected(HookError::UnknownError),
622 {{std::format(
623 "HookManager: An unknown exception occurred during inline hook creation for '{}'.", name),
624 ✗ LogLevel::Error}}};
625 ✗ }
626
23/182
✗ Branch 7 → 8 not taken.
✗ Branch 7 → 287 not taken.
✗ Branch 17 → 18 not taken.
✗ Branch 17 → 19 not taken.
✓ Branch 18 → 19 taken 109 times.
✗ Branch 18 → 53 not taken.
✗ Branch 23 → 24 not taken.
✗ Branch 23 → 307 not taken.
✗ Branch 33 → 34 not taken.
✗ Branch 33 → 35 not taken.
✓ Branch 38 → 39 taken 4 times.
✗ Branch 38 → 327 not taken.
✗ Branch 48 → 49 not taken.
✓ Branch 48 → 50 taken 4 times.
✓ Branch 53 → 54 taken 2 times.
✗ Branch 53 → 347 not taken.
✗ Branch 63 → 64 not taken.
✓ Branch 63 → 65 taken 2 times.
✓ Branch 68 → 69 taken 1 time.
✗ Branch 68 → 367 not taken.
✗ Branch 78 → 79 not taken.
✓ Branch 78 → 80 taken 1 time.
✓ Branch 84 → 85 taken 1 time.
✗ Branch 84 → 387 not taken.
✗ Branch 94 → 95 not taken.
✓ Branch 94 → 96 taken 1 time.
✓ Branch 102 → 103 taken 3 times.
✗ Branch 102 → 410 not taken.
✓ Branch 103 → 104 taken 3 times.
✗ Branch 103 → 407 not taken.
✗ Branch 113 → 114 not taken.
✓ Branch 113 → 115 taken 3 times.
✗ Branch 124 → 125 not taken.
✗ Branch 124 → 436 not taken.
✗ Branch 125 → 126 not taken.
✗ Branch 125 → 433 not taken.
✗ Branch 126 → 127 not taken.
✗ Branch 126 → 430 not taken.
✗ Branch 136 → 137 not taken.
✗ Branch 136 → 138 not taken.
✓ Branch 146 → 147 taken 3 times.
✗ Branch 146 → 459 not taken.
✓ Branch 147 → 148 taken 3 times.
✗ Branch 147 → 456 not taken.
✗ Branch 157 → 158 not taken.
✓ Branch 157 → 159 taken 3 times.
✗ Branch 171 → 172 not taken.
✗ Branch 171 → 480 not taken.
✗ Branch 181 → 182 not taken.
✗ Branch 181 → 183 not taken.
✓ Branch 203 → 204 taken 95 times.
✗ Branch 203 → 507 not taken.
✓ Branch 204 → 205 taken 95 times.
✗ Branch 204 → 504 not taken.
✓ Branch 205 → 206 taken 95 times.
✗ Branch 205 → 499 not taken.
✗ Branch 207 → 208 not taken.
✓ Branch 207 → 209 taken 95 times.
✓ Branch 212 → 213 taken 3 times.
✗ Branch 212 → 517 not taken.
✓ Branch 213 → 214 taken 3 times.
✗ Branch 213 → 514 not taken.
✓ Branch 214 → 215 taken 3 times.
✗ Branch 214 → 509 not taken.
✗ Branch 216 → 217 not taken.
✓ Branch 216 → 218 taken 3 times.
✗ Branch 221 → 222 not taken.
✗ Branch 221 → 530 not taken.
✗ Branch 222 → 223 not taken.
✗ Branch 222 → 527 not taken.
✗ Branch 223 → 224 not taken.
✗ Branch 223 → 524 not taken.
✗ Branch 224 → 225 not taken.
✗ Branch 224 → 519 not taken.
✗ Branch 226 → 227 not taken.
✗ Branch 226 → 228 not taken.
✗ Branch 233 → 234 not taken.
✗ Branch 233 → 540 not taken.
✗ Branch 234 → 235 not taken.
✗ Branch 234 → 537 not taken.
✗ Branch 235 → 236 not taken.
✗ Branch 235 → 532 not taken.
✗ Branch 237 → 238 not taken.
✗ Branch 237 → 239 not taken.
✗ Branch 243 → 244 not taken.
✗ Branch 243 → 548 not taken.
✗ Branch 244 → 245 not taken.
✗ Branch 244 → 543 not taken.
✗ Branch 246 → 247 not taken.
✗ Branch 246 → 248 not taken.
✗ Branch 284 → 285 not taken.
✗ Branch 284 → 286 not taken.
✗ Branch 288 → 289 not taken.
✗ Branch 288 → 292 not taken.
✗ Branch 290 → 291 not taken.
✗ Branch 290 → 292 not taken.
✗ Branch 304 → 305 not taken.
✗ Branch 304 → 306 not taken.
✗ Branch 308 → 309 not taken.
✗ Branch 308 → 312 not taken.
✗ Branch 310 → 311 not taken.
✗ Branch 310 → 312 not taken.
✗ Branch 324 → 325 not taken.
✗ Branch 324 → 326 not taken.
✗ Branch 328 → 329 not taken.
✗ Branch 328 → 332 not taken.
✗ Branch 330 → 331 not taken.
✗ Branch 330 → 332 not taken.
✗ Branch 344 → 345 not taken.
✗ Branch 344 → 346 not taken.
✗ Branch 348 → 349 not taken.
✗ Branch 348 → 352 not taken.
✗ Branch 350 → 351 not taken.
✗ Branch 350 → 352 not taken.
✗ Branch 364 → 365 not taken.
✗ Branch 364 → 366 not taken.
✗ Branch 368 → 369 not taken.
✗ Branch 368 → 372 not taken.
✗ Branch 370 → 371 not taken.
✗ Branch 370 → 372 not taken.
✗ Branch 384 → 385 not taken.
✗ Branch 384 → 386 not taken.
✗ Branch 388 → 389 not taken.
✗ Branch 388 → 392 not taken.
✗ Branch 390 → 391 not taken.
✗ Branch 390 → 392 not taken.
✗ Branch 404 → 405 not taken.
✗ Branch 404 → 406 not taken.
✗ Branch 411 → 412 not taken.
✗ Branch 411 → 415 not taken.
✗ Branch 413 → 414 not taken.
✗ Branch 413 → 415 not taken.
✗ Branch 427 → 428 not taken.
✗ Branch 427 → 429 not taken.
✗ Branch 437 → 438 not taken.
✗ Branch 437 → 441 not taken.
✗ Branch 439 → 440 not taken.
✗ Branch 439 → 441 not taken.
✗ Branch 453 → 454 not taken.
✗ Branch 453 → 455 not taken.
✗ Branch 461 → 462 not taken.
✗ Branch 461 → 465 not taken.
✗ Branch 463 → 464 not taken.
✗ Branch 463 → 465 not taken.
✗ Branch 477 → 478 not taken.
✗ Branch 477 → 479 not taken.
✗ Branch 487 → 488 not taken.
✗ Branch 487 → 491 not taken.
✗ Branch 489 → 490 not taken.
✗ Branch 489 → 491 not taken.
✗ Branch 501 → 502 not taken.
✗ Branch 501 → 503 not taken.
✗ Branch 511 → 512 not taken.
✗ Branch 511 → 513 not taken.
✗ Branch 521 → 522 not taken.
✗ Branch 521 → 523 not taken.
✗ Branch 534 → 535 not taken.
✗ Branch 534 → 536 not taken.
✗ Branch 545 → 546 not taken.
✗ Branch 545 → 547 not taken.
✗ Branch 571 → 572 not taken.
✗ Branch 571 → 609 not taken.
✗ Branch 581 → 582 not taken.
✗ Branch 581 → 583 not taken.
✗ Branch 586 → 587 not taken.
✗ Branch 586 → 632 not taken.
✗ Branch 596 → 597 not taken.
✗ Branch 596 → 598 not taken.
✗ Branch 598 → 272 not taken.
✗ Branch 598 → 644 not taken.
✗ Branch 606 → 607 not taken.
✗ Branch 606 → 608 not taken.
✗ Branch 611 → 612 not taken.
✗ Branch 611 → 615 not taken.
✗ Branch 613 → 614 not taken.
✗ Branch 613 → 615 not taken.
✗ Branch 629 → 630 not taken.
✗ Branch 629 → 631 not taken.
✗ Branch 633 → 634 not taken.
✗ Branch 633 → 637 not taken.
✗ Branch 635 → 636 not taken.
✗ Branch 635 → 637 not taken.
 434 }();
627
628
2/2
✓ Branch 36 → 23 taken 112 times.
✓ Branch 36 → 37 taken 109 times.
 330 for (const auto &entry : deferred_logs)
629 {
630
1/2
✓ Branch 26 → 27 taken 112 times.
✗ Branch 26 → 54 not taken.
 112 m_logger.log(entry.level, entry.msg);
631 }
632
2/2
✓ Branch 38 → 39 taken 95 times.
✓ Branch 38 → 42 taken 14 times.
 109 if (result)
633 {
634 95 emit_hook_lifecycle(*result, Diagnostics::HookKind::Inline, Diagnostics::HookTransition::Created);
635 }
636 109 return result;
637
1/4
✗ Branch 43 → 44 not taken.
✓ Branch 43 → 45 taken 109 times.
✗ Branch 55 → 56 not taken.
✗ Branch 55 → 57 not taken.
 218 }
638
639 std::expected<std::string, HookError>
640 9 HookManager::create_inline_hook_aob(std::string_view name, uintptr_t module_base, size_t module_size,
641 std::string_view aob_pattern_str, ptrdiff_t aob_offset, void *detour_function,
642 void **original_trampoline, const HookConfig &config)
643 {
644
2/2
✓ Branch 3 → 4 taken 1 time.
✓ Branch 3 → 10 taken 8 times.
 9 if (get_reentrancy_guard() > 0)
645 {
646
1/2
✓ Branch 4 → 5 taken 1 time.
✗ Branch 4 → 6 not taken.
 1 if (original_trampoline)
647 1 *original_trampoline = nullptr;
648
1/2
✓ Branch 6 → 7 taken 1 time.
✗ Branch 6 → 43 not taken.
 1 m_logger.error(
649 "HookManager: Reentrant create_inline_hook_aob('{}') from within a with_*/try_with_* callback "
650 "rejected; defer hook mutation until the callback returns.",
651 name);
652 1 return std::unexpected(HookError::ReentrantCallRejected);
653 }
654
655
1/2
✓ Branch 11 → 12 taken 8 times.
✗ Branch 11 → 44 not taken.
 8 m_logger.debug("HookManager: Attempting AOB scan for inline hook '{}' with pattern: \"{}\", offset: {}.", name,
656
1/2
✓ Branch 10 → 11 taken 8 times.
✗ Branch 10 → 47 not taken.
 16 aob_pattern_str, DetourModKit::Format::format_hex(aob_offset));
657
658
1/2
✓ Branch 13 → 14 taken 8 times.
✗ Branch 13 → 62 not taken.
 8 auto pattern = parse_aob(aob_pattern_str);
659
2/2
✓ Branch 15 → 16 taken 3 times.
✓ Branch 15 → 22 taken 5 times.
 8 if (!pattern.has_value())
660 {
661
1/2
✓ Branch 16 → 17 taken 3 times.
✗ Branch 16 → 48 not taken.
 3 m_logger.error("HookManager: AOB pattern parsing failed for inline hook '{}'. Pattern: \"{}\".", name,
662 aob_pattern_str);
663
1/2
✓ Branch 17 → 18 taken 3 times.
✗ Branch 17 → 19 not taken.
 3 if (original_trampoline)
664 3 *original_trampoline = nullptr;
665 3 return std::unexpected(HookError::InvalidTargetAddress);
666 }
667
668 // Page-filtered scan over [module_base, module_base + module_size): the module-scoped sweep walks VirtualQuery
669 // and skips guard, no-access, and non-readable pages, so a guard / no-access section inside the SizeOfImage
670 // span cannot fault the host the way a raw find_pattern over the whole span would. A signature straddling a
671 // protection split inside the image is still found (the sweep carries the cross-region overlap), and
672 // pattern.offset is applied exactly once, matching the raw find_pattern contract.
673 10 const std::byte *found_address_start = Scanner::detail::scan_module_readable(
674
1/2
✓ Branch 22 → 23 taken 5 times.
✗ Branch 22 → 60 not taken.
 5 pattern.value(), Memory::ModuleRange{module_base, module_base + module_size}, 1);
675
2/2
✓ Branch 24 → 25 taken 3 times.
✓ Branch 24 → 31 taken 2 times.
 5 if (!found_address_start)
676 {
677
1/2
✓ Branch 25 → 26 taken 3 times.
✗ Branch 25 → 49 not taken.
 3 m_logger.error("HookManager: AOB pattern not found for inline hook '{}'. Pattern: \"{}\".", name,
678 aob_pattern_str);
679
1/2
✓ Branch 26 → 27 taken 3 times.
✗ Branch 26 → 28 not taken.
 3 if (original_trampoline)
680 3 *original_trampoline = nullptr;
681 3 return std::unexpected(HookError::InvalidTargetAddress);
682 }
683
684 2 uintptr_t target_address = reinterpret_cast<uintptr_t>(found_address_start) + aob_offset;
685
1/2
✓ Branch 34 → 35 taken 2 times.
✗ Branch 34 → 50 not taken.
 2 m_logger.debug(
686 "HookManager: AOB pattern for inline hook '{}' found at {}. Applying offset {}. Final target hook "
687 "address: {}.",
688
1/2
✓ Branch 33 → 34 taken 2 times.
✗ Branch 33 → 53 not taken.
 4 name, DetourModKit::Format::format_address(reinterpret_cast<uintptr_t>(found_address_start)),
689
2/4
✓ Branch 31 → 32 taken 2 times.
✗ Branch 31 → 59 not taken.
✓ Branch 32 → 33 taken 2 times.
✗ Branch 32 → 56 not taken.
 4 DetourModKit::Format::format_hex(aob_offset), DetourModKit::Format::format_address(target_address));
690
691
1/2
✓ Branch 38 → 39 taken 2 times.
✗ Branch 38 → 60 not taken.
 2 return create_inline_hook(name, target_address, detour_function, original_trampoline, config);
692 8 }
693
694 34 std::expected<std::string, HookError> HookManager::create_mid_hook(std::string_view name, uintptr_t target_address,
695 safetyhook::MidHookFn detour_function,
696 const HookConfig &config)
697 {
698
1/2
✗ Branch 3 → 4 not taken.
✓ Branch 3 → 8 taken 34 times.
 34 if (m_shutdown_called.load(std::memory_order_acquire))
699 {
700 ✗ m_logger.error("HookManager: Shutdown in progress. Cannot create mid hook '{}'.", name);
701 ✗ return std::unexpected(HookError::ShutdownInProgress);
702 }
703 // Fail closed on a reentrant call from inside a with_*/try_with_* callback: it holds m_hooks_mutex shared, so
704 // re-acquiring this non-recursive lock here is UB / deadlock. Defer the mutation past the callback.
705
2/2
✓ Branch 9 → 10 taken 1 time.
✓ Branch 9 → 14 taken 33 times.
 34 if (get_reentrancy_guard() > 0)
706 {
707
1/2
✓ Branch 10 → 11 taken 1 time.
✗ Branch 10 → 48 not taken.
 1 m_logger.error("HookManager: Reentrant create_mid_hook('{}') from within a with_*/try_with_* callback "
708 "rejected; defer hook mutation until the callback returns.",
709 name);
710 1 return std::unexpected(HookError::ReentrantCallRejected);
711 }
712
713 33 auto [result,
714 33 deferred_logs] = [&]() -> std::pair<std::expected<std::string, HookError>, std::vector<DeferredLogEntry>>
715 {
716 33 std::shared_lock<detail::SrwSharedMutex> mutator_gate(m_mutator_gate);
717
1/2
✓ Branch 3 → 4 taken 33 times.
✗ Branch 3 → 612 not taken.
 33 std::unique_lock<detail::SrwSharedMutex> lock(m_hooks_mutex);
718
719
1/2
✗ Branch 5 → 6 not taken.
✓ Branch 5 → 20 taken 33 times.
 33 if (m_shutdown_called.load(std::memory_order_acquire))
720 {
721 ✗ return {std::unexpected(HookError::ShutdownInProgress),
722 {{std::format("HookManager: Shutdown in progress. Cannot create mid hook '{}'.", name),
723 ✗ LogLevel::Error}}};
724 }
725
1/2
✗ Branch 21 → 22 not taken.
✓ Branch 21 → 36 taken 33 times.
 33 if (!m_allocator)
726 {
727 ✗ return {std::unexpected(HookError::AllocatorNotAvailable),
728 {{std::format("HookManager: Allocator not available. Cannot create mid hook '{}'.", name),
729 ✗ LogLevel::Error}}};
730 }
731
2/2
✓ Branch 36 → 37 taken 3 times.
✓ Branch 36 → 51 taken 30 times.
 33 if (target_address == 0)
732 {
733 return {
734 3 std::unexpected(HookError::InvalidTargetAddress),
735
3/6
✓ Branch 41 → 42 taken 3 times.
✗ Branch 41 → 301 not taken.
✓ Branch 46 → 47 taken 3 times.
✓ Branch 46 → 48 taken 3 times.
✗ Branch 305 → 306 not taken.
✗ Branch 305 → 307 not taken.
 9 {{std::format("HookManager: Target address is NULL for mid hook '{}'.", name), LogLevel::Error}}};
736 }
737
2/2
✓ Branch 51 → 52 taken 1 time.
✓ Branch 51 → 66 taken 29 times.
 30 if (detour_function == nullptr)
738 {
739 return {
740 1 std::unexpected(HookError::InvalidDetourFunction),
741
3/6
✓ Branch 56 → 57 taken 1 time.
✗ Branch 56 → 321 not taken.
✓ Branch 61 → 62 taken 1 time.
✓ Branch 61 → 63 taken 1 time.
✗ Branch 325 → 326 not taken.
✗ Branch 325 → 327 not taken.
 3 {{std::format("HookManager: Detour function is NULL for mid hook '{}'.", name), LogLevel::Error}}};
742 }
743
744
3/4
✓ Branch 66 → 67 taken 29 times.
✗ Branch 66 → 610 not taken.
✓ Branch 67 → 68 taken 1 time.
✓ Branch 67 → 82 taken 28 times.
 29 if (hook_id_exists_locked(name))
745 {
746 return {
747 1 std::unexpected(HookError::HookAlreadyExists),
748
3/6
✓ Branch 72 → 73 taken 1 time.
✗ Branch 72 → 341 not taken.
✓ Branch 77 → 78 taken 1 time.
✓ Branch 77 → 79 taken 1 time.
✗ Branch 345 → 346 not taken.
✗ Branch 345 → 347 not taken.
 3 {{std::format("HookManager: A hook with the name '{}' already exists.", name), LogLevel::Error}}};
749 }
750
751 // Mid hooks are implemented as SafetyHook inline hooks at the requested address, so they participate in the
752 // same address-layering rules as create_inline_hook().
753 28 std::string layered_on_managed_hook;
754
2/2
✓ Branch 84 → 85 taken 2 times.
✓ Branch 84 → 103 taken 26 times.
 28 if (const std::string *self_owner = find_hook_owner_of_target_locked(target_address))
755 {
756
1/2
✓ Branch 85 → 86 taken 2 times.
✗ Branch 85 → 102 not taken.
 2 if (config.fail_if_already_hooked)
757 {
758 2 return {std::unexpected(HookError::TargetAlreadyHookedInProcess),
759 {{std::format("HookManager: Target {} for mid hook '{}' is already hooked by managed hook "
760 "'{}'. Aborting under strict mode.",
761 ✗ DetourModKit::Format::format_address(target_address), name, *self_owner),
762
3/6
✓ Branch 91 → 92 taken 2 times.
✗ Branch 91 → 361 not taken.
✓ Branch 96 → 97 taken 2 times.
✓ Branch 96 → 98 taken 2 times.
✗ Branch 365 → 366 not taken.
✗ Branch 365 → 367 not taken.
 8 LogLevel::Error}}};
763 }
764 ✗ layered_on_managed_hook = *self_owner;
765 }
766
767 26 PrehookDetection prehook;
768
1/2
✓ Branch 104 → 105 taken 26 times.
✗ Branch 104 → 126 not taken.
 26 if (layered_on_managed_hook.empty())
769 {
770 26 prehook = detect_existing_inline_hook(target_address);
771
1/4
✗ Branch 106 → 107 not taken.
✓ Branch 106 → 126 taken 26 times.
✗ Branch 107 → 108 not taken.
✗ Branch 107 → 126 not taken.
 26 if (prehook.state == PrehookState::HookedByOtherModule && config.fail_if_already_hooked)
772 {
773 ✗ return {std::unexpected(HookError::TargetAlreadyHookedInProcess),
774 {{std::format(
775 "HookManager: Target {} for mid hook '{}' is already inline-hooked by another module "
776 "(JMP -> {}). Aborting under strict mode.",
777 ✗ DetourModKit::Format::format_address(target_address), name,
778 ✗ DetourModKit::Format::format_address(prehook.jmp_destination)),
779 ✗ LogLevel::Error}}};
780 }
781 }
782
783 // Prologue pre-flight, identical to create_inline_hook: a mid hook is a SafetyHook inline hook at the
784 // address, so it patches the same prologue and carries the same E8 / breakpoint hazard. Refuse under Fail;
785 // warn (the default) is emitted in the success block below.
786 26 const PrologueRisk prologue_risk = classify_prologue_risk(target_address);
787
3/4
✓ Branch 127 → 128 taken 1 time.
✓ Branch 127 → 146 taken 25 times.
✓ Branch 128 → 129 taken 1 time.
✗ Branch 128 → 146 not taken.
 26 if (prologue_risk != PrologueRisk::None && config.prologue_policy == InlineProloguePolicy::Fail)
788 {
789 1 return {std::unexpected(HookError::TargetPrologueUnsafe),
790 {{std::format("HookManager: Target {} for mid hook '{}' begins with {}; refusing under Fail "
791 "prologue policy.",
792 ✗ DetourModKit::Format::format_address(target_address), name,
793 ✗ prologue_risk_description(prologue_risk)),
794
3/6
✓ Branch 135 → 136 taken 1 time.
✗ Branch 135 → 410 not taken.
✓ Branch 140 → 141 taken 1 time.
✓ Branch 140 → 142 taken 1 time.
✗ Branch 414 → 415 not taken.
✗ Branch 414 → 416 not taken.
 4 LogLevel::Error}}};
795 }
796
797 try
798 {
799
2/2
✓ Branch 146 → 147 taken 23 times.
✓ Branch 146 → 148 taken 2 times.
 25 auto sh_flags = config.auto_enable ? safetyhook::MidHook::Default : safetyhook::MidHook::StartDisabled;
800
801 auto hook_creation_result = safetyhook::MidHook::create(
802
1/2
✓ Branch 149 → 150 taken 25 times.
✗ Branch 149 → 530 not taken.
 25 m_allocator, reinterpret_cast<void *>(target_address), detour_function, sh_flags);
803
804
1/2
✗ Branch 151 → 152 not taken.
✓ Branch 151 → 171 taken 25 times.
 25 if (!hook_creation_result)
805 {
806 ✗ return {std::unexpected(HookError::SafetyHookError),
807 {{std::format("HookManager: Failed to create SafetyHook::MidHook for '{}' at {}. Error: {}",
808 ✗ name, DetourModKit::Format::format_address(target_address),
809 ✗ error_to_string(hook_creation_result.error())),
810 ✗ LogLevel::Error}}};
811 }
812
813
1/2
✓ Branch 171 → 172 taken 25 times.
✗ Branch 171 → 528 not taken.
 50 auto sh_mid_hook = std::move(hook_creation_result.value());
814
815
2/2
✓ Branch 176 → 177 taken 23 times.
✓ Branch 176 → 178 taken 2 times.
 25 HookStatus initial_status = sh_mid_hook.enabled() ? HookStatus::Active : HookStatus::Disabled;
816
817 // Pre-build log entries before committing to m_hooks so that allocation failures in std::format cannot
818 // leave a ghost hook.
819
3/4
✓ Branch 181 → 182 taken 23 times.
✓ Branch 181 → 183 taken 2 times.
✓ Branch 184 → 185 taken 25 times.
✗ Branch 184 → 460 not taken.
 25 std::string status_message = (initial_status == HookStatus::Active) ? "and enabled" : "(disabled)";
820 25 std::vector<DeferredLogEntry> logs;
821
1/2
✓ Branch 186 → 187 taken 25 times.
✗ Branch 186 → 522 not taken.
 25 logs.reserve(3);
822 25 logs.push_back({std::format("HookManager: Successfully created {} mid hook '{}' targeting {}.",
823 ✗ status_message, name, DetourModKit::Format::format_address(target_address)),
824 LogLevel::Info});
825
826
1/2
✗ Branch 195 → 196 not taken.
✓ Branch 195 → 204 taken 25 times.
 25 if (!layered_on_managed_hook.empty())
827 {
828 ✗ logs.push_back(
829 {std::format("HookManager: Target {} for mid hook '{}' is already hooked by managed hook '{}'; "
830 "SafetyHook layered on top. Remove layered hooks newest-first.",
831 ✗ DetourModKit::Format::format_address(target_address), name,
832 layered_on_managed_hook),
833 LogLevel::Warning});
834 }
835
1/2
✗ Branch 204 → 205 not taken.
✓ Branch 204 → 215 taken 25 times.
 25 else if (prehook.state == PrehookState::HookedByOtherModule)
836 {
837 ✗ logs.push_back(
838 {std::format("HookManager: Target {} for mid hook '{}' was already inline-hooked by another "
839 "module (JMP -> {}); SafetyHook layered on top.",
840 ✗ DetourModKit::Format::format_address(target_address), name,
841 ✗ DetourModKit::Format::format_address(prehook.jmp_destination)),
842 LogLevel::Warning});
843 }
844
845
1/2
✗ Branch 215 → 216 not taken.
✓ Branch 215 → 225 taken 25 times.
 25 if (prologue_risk != PrologueRisk::None)
846 {
847 ✗ logs.push_back(
848 {std::format(
849 "HookManager: Target {} for mid hook '{}' begins with {}; installed anyway under Warn "
850 "prologue policy.",
851 ✗ DetourModKit::Format::format_address(target_address), name,
852 ✗ prologue_risk_description(prologue_risk)),
853 LogLevel::Warning});
854 }
855
856
3/4
✓ Branch 225 → 226 taken 2 times.
✓ Branch 225 → 233 taken 23 times.
✗ Branch 226 → 227 not taken.
✓ Branch 226 → 233 taken 2 times.
 25 if (initial_status == HookStatus::Disabled && config.auto_enable)
857 {
858 ✗ logs.push_back({std::format("HookManager: Mid hook '{}' was configured for auto-enable "
859 "but is currently disabled post-creation.",
860 name),
861 LogLevel::Warning});
862 }
863
864
1/2
✓ Branch 235 → 236 taken 25 times.
✗ Branch 235 → 514 not taken.
 75 std::string name_str{name};
865 auto managed_hook =
866
1/2
✓ Branch 239 → 240 taken 25 times.
✗ Branch 239 → 520 not taken.
 25 std::make_unique<MidHook>(name_str, target_address, std::move(sh_mid_hook), initial_status);
867 // Record creation order before emplace so layered hooks unwind newest-first at teardown; a stale entry
868 // from a throwing emplace is a harmless skip there. Mid hooks share m_hooks and the same
869 // prologue-overlap hazard as inline hooks, so they participate in the same ordered teardown.
870
1/2
✓ Branch 240 → 241 taken 25 times.
✗ Branch 240 → 518 not taken.
 25 m_hook_creation_order.push_back(name_str);
871
1/2
✓ Branch 243 → 244 taken 25 times.
✗ Branch 243 → 517 not taken.
 50 m_hooks.emplace(name_str, std::move(managed_hook));
872
873 50 return {std::move(name_str), std::move(logs)};
874 25 }
875 ✗ catch (const std::exception &e)
876 {
877 ✗ return {std::unexpected(HookError::UnknownError),
878 {{std::format("HookManager: An std::exception occurred during mid hook creation for '{}': {}",
879 ✗ name, e.what()),
880 ✗ LogLevel::Error}}};
881 ✗ }
882 ✗ catch (...)
883 {
884 ✗ return {std::unexpected(HookError::UnknownError),
885 {{std::format("HookManager: An unknown exception occurred during mid hook creation for '{}'.",
886 name),
887 ✗ LogLevel::Error}}};
888 ✗ }
889
17/172
✗ Branch 7 → 8 not taken.
✗ Branch 7 → 271 not taken.
✓ Branch 14 → 15 taken 33 times.
✗ Branch 14 → 49 not taken.
✗ Branch 17 → 18 not taken.
✗ Branch 17 → 19 not taken.
✗ Branch 23 → 24 not taken.
✗ Branch 23 → 291 not taken.
✗ Branch 33 → 34 not taken.
✗ Branch 33 → 35 not taken.
✓ Branch 38 → 39 taken 3 times.
✗ Branch 38 → 311 not taken.
✗ Branch 48 → 49 not taken.
✓ Branch 48 → 50 taken 3 times.
✓ Branch 53 → 54 taken 1 time.
✗ Branch 53 → 331 not taken.
✗ Branch 63 → 64 not taken.
✓ Branch 63 → 65 taken 1 time.
✓ Branch 69 → 70 taken 1 time.
✗ Branch 69 → 351 not taken.
✗ Branch 79 → 80 not taken.
✓ Branch 79 → 81 taken 1 time.
✓ Branch 87 → 88 taken 2 times.
✗ Branch 87 → 374 not taken.
✓ Branch 88 → 89 taken 2 times.
✗ Branch 88 → 371 not taken.
✗ Branch 98 → 99 not taken.
✓ Branch 98 → 100 taken 2 times.
✗ Branch 109 → 110 not taken.
✗ Branch 109 → 400 not taken.
✗ Branch 110 → 111 not taken.
✗ Branch 110 → 397 not taken.
✗ Branch 111 → 112 not taken.
✗ Branch 111 → 394 not taken.
✗ Branch 121 → 122 not taken.
✗ Branch 121 → 123 not taken.
✓ Branch 131 → 132 taken 1 time.
✗ Branch 131 → 423 not taken.
✓ Branch 132 → 133 taken 1 time.
✗ Branch 132 → 420 not taken.
✗ Branch 142 → 143 not taken.
✓ Branch 142 → 144 taken 1 time.
✗ Branch 156 → 157 not taken.
✗ Branch 156 → 444 not taken.
✗ Branch 166 → 167 not taken.
✗ Branch 166 → 168 not taken.
✓ Branch 187 → 188 taken 25 times.
✗ Branch 187 → 471 not taken.
✓ Branch 188 → 189 taken 25 times.
✗ Branch 188 → 468 not taken.
✓ Branch 189 → 190 taken 25 times.
✗ Branch 189 → 463 not taken.
✗ Branch 191 → 192 not taken.
✓ Branch 191 → 193 taken 25 times.
✗ Branch 196 → 197 not taken.
✗ Branch 196 → 481 not taken.
✗ Branch 197 → 198 not taken.
✗ Branch 197 → 478 not taken.
✗ Branch 198 → 199 not taken.
✗ Branch 198 → 473 not taken.
✗ Branch 200 → 201 not taken.
✗ Branch 200 → 202 not taken.
✗ Branch 205 → 206 not taken.
✗ Branch 205 → 494 not taken.
✗ Branch 206 → 207 not taken.
✗ Branch 206 → 491 not taken.
✗ Branch 207 → 208 not taken.
✗ Branch 207 → 488 not taken.
✗ Branch 208 → 209 not taken.
✗ Branch 208 → 483 not taken.
✗ Branch 210 → 211 not taken.
✗ Branch 210 → 212 not taken.
✗ Branch 217 → 218 not taken.
✗ Branch 217 → 504 not taken.
✗ Branch 218 → 219 not taken.
✗ Branch 218 → 501 not taken.
✗ Branch 219 → 220 not taken.
✗ Branch 219 → 496 not taken.
✗ Branch 221 → 222 not taken.
✗ Branch 221 → 223 not taken.
✗ Branch 227 → 228 not taken.
✗ Branch 227 → 512 not taken.
✗ Branch 228 → 229 not taken.
✗ Branch 228 → 507 not taken.
✗ Branch 230 → 231 not taken.
✗ Branch 230 → 232 not taken.
✗ Branch 268 → 269 not taken.
✗ Branch 268 → 270 not taken.
✗ Branch 272 → 273 not taken.
✗ Branch 272 → 276 not taken.
✗ Branch 274 → 275 not taken.
✗ Branch 274 → 276 not taken.
✗ Branch 288 → 289 not taken.
✗ Branch 288 → 290 not taken.
✗ Branch 292 → 293 not taken.
✗ Branch 292 → 296 not taken.
✗ Branch 294 → 295 not taken.
✗ Branch 294 → 296 not taken.
✗ Branch 308 → 309 not taken.
✗ Branch 308 → 310 not taken.
✗ Branch 312 → 313 not taken.
✗ Branch 312 → 316 not taken.
✗ Branch 314 → 315 not taken.
✗ Branch 314 → 316 not taken.
✗ Branch 328 → 329 not taken.
✗ Branch 328 → 330 not taken.
✗ Branch 332 → 333 not taken.
✗ Branch 332 → 336 not taken.
✗ Branch 334 → 335 not taken.
✗ Branch 334 → 336 not taken.
✗ Branch 348 → 349 not taken.
✗ Branch 348 → 350 not taken.
✗ Branch 352 → 353 not taken.
✗ Branch 352 → 356 not taken.
✗ Branch 354 → 355 not taken.
✗ Branch 354 → 356 not taken.
✗ Branch 368 → 369 not taken.
✗ Branch 368 → 370 not taken.
✗ Branch 375 → 376 not taken.
✗ Branch 375 → 379 not taken.
✗ Branch 377 → 378 not taken.
✗ Branch 377 → 379 not taken.
✗ Branch 391 → 392 not taken.
✗ Branch 391 → 393 not taken.
✗ Branch 401 → 402 not taken.
✗ Branch 401 → 405 not taken.
✗ Branch 403 → 404 not taken.
✗ Branch 403 → 405 not taken.
✗ Branch 417 → 418 not taken.
✗ Branch 417 → 419 not taken.
✗ Branch 425 → 426 not taken.
✗ Branch 425 → 429 not taken.
✗ Branch 427 → 428 not taken.
✗ Branch 427 → 429 not taken.
✗ Branch 441 → 442 not taken.
✗ Branch 441 → 443 not taken.
✗ Branch 451 → 452 not taken.
✗ Branch 451 → 455 not taken.
✗ Branch 453 → 454 not taken.
✗ Branch 453 → 455 not taken.
✗ Branch 465 → 466 not taken.
✗ Branch 465 → 467 not taken.
✗ Branch 475 → 476 not taken.
✗ Branch 475 → 477 not taken.
✗ Branch 485 → 486 not taken.
✗ Branch 485 → 487 not taken.
✗ Branch 498 → 499 not taken.
✗ Branch 498 → 500 not taken.
✗ Branch 509 → 510 not taken.
✗ Branch 509 → 511 not taken.
✗ Branch 535 → 536 not taken.
✗ Branch 535 → 573 not taken.
✗ Branch 545 → 546 not taken.
✗ Branch 545 → 547 not taken.
✗ Branch 550 → 551 not taken.
✗ Branch 550 → 596 not taken.
✗ Branch 560 → 561 not taken.
✗ Branch 560 → 562 not taken.
✗ Branch 562 → 256 not taken.
✗ Branch 562 → 608 not taken.
✗ Branch 570 → 571 not taken.
✗ Branch 570 → 572 not taken.
✗ Branch 575 → 576 not taken.
✗ Branch 575 → 579 not taken.
✗ Branch 577 → 578 not taken.
✗ Branch 577 → 579 not taken.
✗ Branch 593 → 594 not taken.
✗ Branch 593 → 595 not taken.
✗ Branch 597 → 598 not taken.
✗ Branch 597 → 601 not taken.
✗ Branch 599 → 600 not taken.
✗ Branch 599 → 601 not taken.
 127 }();
890
891
2/2
✓ Branch 32 → 19 taken 33 times.
✓ Branch 32 → 33 taken 33 times.
 99 for (const auto &entry : deferred_logs)
892 {
893
1/2
✓ Branch 22 → 23 taken 33 times.
✗ Branch 22 → 50 not taken.
 33 m_logger.log(entry.level, entry.msg);
894 }
895
2/2
✓ Branch 34 → 35 taken 25 times.
✓ Branch 34 → 38 taken 8 times.
 33 if (result)
896 {
897 25 emit_hook_lifecycle(*result, Diagnostics::HookKind::Mid, Diagnostics::HookTransition::Created);
898 }
899 33 return result;
900
1/4
✗ Branch 39 → 40 not taken.
✓ Branch 39 → 41 taken 33 times.
✗ Branch 51 → 52 not taken.
✗ Branch 51 → 53 not taken.
 66 }
901
902 std::expected<std::string, HookError>
903 7 HookManager::create_mid_hook_aob(std::string_view name, uintptr_t module_base, size_t module_size,
904 std::string_view aob_pattern_str, ptrdiff_t aob_offset,
905 safetyhook::MidHookFn detour_function, const HookConfig &config)
906 {
907
2/2
✓ Branch 3 → 4 taken 1 time.
✓ Branch 3 → 8 taken 6 times.
 7 if (get_reentrancy_guard() > 0)
908 {
909
1/2
✓ Branch 4 → 5 taken 1 time.
✗ Branch 4 → 37 not taken.
 1 m_logger.error("HookManager: Reentrant create_mid_hook_aob('{}') from within a with_*/try_with_* callback "
910 "rejected; defer hook mutation until the callback returns.",
911 name);
912 1 return std::unexpected(HookError::ReentrantCallRejected);
913 }
914
915
1/2
✓ Branch 9 → 10 taken 6 times.
✗ Branch 9 → 38 not taken.
 6 m_logger.debug("HookManager: Attempting AOB scan for mid hook '{}' with pattern: \"{}\", offset: {}.", name,
916
1/2
✓ Branch 8 → 9 taken 6 times.
✗ Branch 8 → 41 not taken.
 12 aob_pattern_str, DetourModKit::Format::format_hex(aob_offset));
917
918
1/2
✓ Branch 11 → 12 taken 6 times.
✗ Branch 11 → 56 not taken.
 6 auto pattern = parse_aob(aob_pattern_str);
919
2/2
✓ Branch 13 → 14 taken 2 times.
✓ Branch 13 → 18 taken 4 times.
 6 if (!pattern.has_value())
920 {
921
1/2
✓ Branch 14 → 15 taken 2 times.
✗ Branch 14 → 42 not taken.
 2 m_logger.error("HookManager: AOB pattern parsing failed for mid hook '{}'. Pattern: \"{}\".", name,
922 aob_pattern_str);
923 2 return std::unexpected(HookError::InvalidTargetAddress);
924 }
925
926 // Page-filtered scan over [module_base, module_base + module_size): the module-scoped sweep walks VirtualQuery
927 // and skips guard, no-access, and non-readable pages, so a guard / no-access section inside the SizeOfImage
928 // span cannot fault the host the way a raw find_pattern over the whole span would. A signature straddling a
929 // protection split inside the image is still found (the sweep carries the cross-region overlap), and
930 // pattern.offset is applied exactly once, matching the raw find_pattern contract.
931 8 const std::byte *found_address_start = Scanner::detail::scan_module_readable(
932
1/2
✓ Branch 18 → 19 taken 4 times.
✗ Branch 18 → 54 not taken.
 4 pattern.value(), Memory::ModuleRange{module_base, module_base + module_size}, 1);
933
2/2
✓ Branch 20 → 21 taken 3 times.
✓ Branch 20 → 25 taken 1 time.
 4 if (!found_address_start)
934 {
935
1/2
✓ Branch 21 → 22 taken 3 times.
✗ Branch 21 → 43 not taken.
 3 m_logger.error("HookManager: AOB pattern not found for mid hook '{}'. Pattern: \"{}\".", name,
936 aob_pattern_str);
937 3 return std::unexpected(HookError::InvalidTargetAddress);
938 }
939
940 1 uintptr_t target_address = reinterpret_cast<uintptr_t>(found_address_start) + aob_offset;
941
1/2
✓ Branch 28 → 29 taken 1 time.
✗ Branch 28 → 44 not taken.
 1 m_logger.debug("HookManager: AOB pattern for mid hook '{}' found at {}. Applying offset {}. Final target hook "
942 "address: {}.",
943
1/2
✓ Branch 27 → 28 taken 1 time.
✗ Branch 27 → 47 not taken.
 2 name, DetourModKit::Format::format_address(reinterpret_cast<uintptr_t>(found_address_start)),
944
1/2
✓ Branch 26 → 27 taken 1 time.
✗ Branch 26 → 50 not taken.
 2 DetourModKit::Format::format_hex(aob_offset),
945
1/2
✓ Branch 25 → 26 taken 1 time.
✗ Branch 25 → 53 not taken.
 2 DetourModKit::Format::format_address(target_address));
946
947
1/2
✓ Branch 32 → 33 taken 1 time.
✗ Branch 32 → 54 not taken.
 1 return create_mid_hook(name, target_address, detour_function, config);
948 6 }
949
950 22 bool HookManager::is_target_already_hooked(uintptr_t target_address) const noexcept
951 {
952
2/2
✓ Branch 2 → 3 taken 1 time.
✓ Branch 2 → 4 taken 21 times.
 22 if (target_address == 0)
953 {
954 1 return false;
955 }
956 21 const auto lock = lock_hooks_shared_reentrant();
957 21 return find_hook_owner_of_target_locked(target_address) != nullptr;
958 21 }
959
960 5 const std::string *HookManager::find_vmt_owner_of_vptr_locked(std::uintptr_t vptr) const noexcept
961 {
962
1/2
✗ Branch 2 → 3 not taken.
✓ Branch 2 → 4 taken 5 times.
 5 if (vptr == 0)
963 {
964 ✗ return nullptr;
965 }
966
2/2
✓ Branch 19 → 6 taken 4 times.
✓ Branch 19 → 20 taken 2 times.
 6 for (const auto &[name, entry] : m_vmt_hooks)
967 {
968
5/6
✓ Branch 10 → 11 taken 4 times.
✗ Branch 10 → 14 not taken.
✓ Branch 12 → 13 taken 3 times.
✓ Branch 12 → 14 taken 1 time.
✓ Branch 15 → 16 taken 3 times.
✓ Branch 15 → 17 taken 1 time.
 4 if (entry.cloned_vptr_base() != 0 && entry.cloned_vptr_base() == vptr)
969 {
970 3 return &name;
971 }
972 }
973 2 return nullptr;
974 }
975
976 150 const std::string *HookManager::find_hook_owner_of_target_locked(uintptr_t target_address) const noexcept
977 {
978
1/2
✗ Branch 2 → 3 not taken.
✓ Branch 2 → 4 taken 150 times.
 150 if (target_address == 0)
979 {
980 ✗ return nullptr;
981 }
982 // Match on the patched address irrespective of hook type: an inline hook and a mid hook (or two of either) at
983 // the same address overlap the same prologue bytes, so both share the layered-teardown hazard.
984
2/2
✓ Branch 15 → 6 taken 38 times.
✓ Branch 15 → 16 taken 133 times.
 171 for (const auto &[name, hook_ptr] : m_hooks)
985 {
986
2/2
✓ Branch 11 → 12 taken 17 times.
✓ Branch 11 → 13 taken 21 times.
 38 if (hook_ptr->get_target_address() == target_address)
987 {
988 17 return &name;
989 }
990 }
991 133 return nullptr;
992 }
993
994 690 void HookManager::clear_vmt_hooks_locked() noexcept
995 {
996 // Newest-first so layered clones unwind with every conditional vptr restore targeting live memory.
997
2/2
✓ Branch 8 → 3 taken 29 times.
✓ Branch 8 → 9 taken 690 times.
 719 for (auto it = m_vmt_creation_order.rbegin(); it != m_vmt_creation_order.rend(); ++it)
998 {
999 29 m_vmt_hooks.erase(*it);
1000 }
1001 690 m_vmt_hooks.clear();
1002 690 m_vmt_creation_order.clear();
1003 690 }
1004
1005 669 void HookManager::disable_hooks_reverse_order_locked() noexcept
1006 {
1007 // Newest-first restore so a hook layered on a shared target rewrites the prologue to the jump into the older
1008 // hook before that older hook restores the true original bytes; see the member doc for the use-after-free this
1009 // ordering prevents. Names absent from m_hooks (a creation that failed after recording its order entry) are
1010 // skipped harmlessly.
1011
2/2
✓ Branch 15 → 3 taken 96 times.
✓ Branch 15 → 16 taken 669 times.
 765 for (auto it = m_hook_creation_order.rbegin(); it != m_hook_creation_order.rend(); ++it)
1012 {
1013 96 auto hook_it = m_hooks.find(*it);
1014
1/2
✓ Branch 7 → 8 taken 96 times.
✗ Branch 7 → 12 not taken.
 96 if (hook_it != m_hooks.end())
1015 {
1016 96 (void)hook_it->second->disable();
1017 }
1018 }
1019 669 }
1020
1021 669 void HookManager::clear_hooks_locked() noexcept
1022 {
1023 // Newest-first for symmetry with the disable phase; every hook is already disabled here, so this only frees
1024 // trampolines.
1025
2/2
✓ Branch 8 → 3 taken 96 times.
✓ Branch 8 → 9 taken 669 times.
 765 for (auto it = m_hook_creation_order.rbegin(); it != m_hook_creation_order.rend(); ++it)
1026 {
1027 96 m_hooks.erase(*it);
1028 }
1029 669 m_hooks.clear();
1030 669 m_hook_creation_order.clear();
1031 669 }
1032
1033 4 bool HookManager::looks_like_function_vmt_slot(std::uintptr_t slot_value) noexcept
1034 {
1035 // A zero vtable slot is the RTTI/garbage sentinel SafetyHook itself rejects in VmtHook::create when probing for
1036 // the vtable end. Treat it as a non-function.
1037
1/2
✗ Branch 2 → 3 not taken.
✓ Branch 2 → 4 taken 4 times.
 4 if (slot_value == 0)
1038 {
1039 ✗ return false;
1040 }
1041
1042 // Reject 0xCC/0xCD padding or breakpoints and bare RETs. A 0x00 first byte is the uninitialised-page sentinel.
1043 4 std::uint8_t first_byte = 0;
1044
1/2
✗ Branch 5 → 6 not taken.
✓ Branch 5 → 7 taken 4 times.
 4 if (!Memory::seh_read_bytes(slot_value, &first_byte, sizeof(first_byte)))
1045 {
1046 // Unreadable: cannot prove it is a function, refuse.
1047 ✗ return false;
1048 }
1049
2/2
✓ Branch 7 → 8 taken 2 times.
✓ Branch 7 → 9 taken 2 times.
 4 switch (first_byte)
1050 {
1051 2 case 0x00:
1052 case 0xCC:
1053 case 0xCD:
1054 case 0xC2:
1055 case 0xC3:
1056 2 return false;
1057 2 default:
1058 2 break;
1059 }
1060
1061 // Same-module jump-stub check. MSVC x64 adjustor thunks begin with the this-adjust instruction (first byte
1062 // 0x48), so they pass this check; a slot whose *first* byte is EB (jmp rel8) or E9 (jmp rel32) landing in the
1063 // same module is a jump stub (an incremental-link ILT entry or a patched slot), not a function body. Cloning a
1064 // stub makes the new "original" a forwarder rather than the real body. "Same module" means HMODULE identity per
1065 // GetModuleHandleExW on the slot and jump-target addresses, not a distance heuristic. Tail-calls that land in a
1066 // foreign module (a `mov reg,reg; jmp <foreign>`) are real functions and pass.
1067
3/4
✓ Branch 10 → 11 taken 2 times.
✗ Branch 10 → 12 not taken.
✓ Branch 11 → 12 taken 1 time.
✓ Branch 11 → 29 taken 1 time.
 2 if (first_byte == 0xEB || first_byte == 0xE9)
1068 {
1069 1 HMODULE slot_module = nullptr;
1070 1 HMODULE jmp_module = nullptr;
1071 1 if (GetModuleHandleExW(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS |
1072 GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT,
1073
1/2
✗ Branch 13 → 14 not taken.
✓ Branch 13 → 15 taken 1 time.
 1 reinterpret_cast<LPCWSTR>(slot_value), &slot_module) == 0)
1074 {
1075 // No module info: cannot prove same-module, let the caller decide. Reject conservatively.
1076 1 return false;
1077 }
1078 // Resolve the jmp target through the same x86 decode primitives the inline-hook pre-flight uses; that way
1079 // EB and E9 share one well-tested decoder path.
1080 1 std::optional<std::uintptr_t> jmp_target;
1081
1/2
✓ Branch 15 → 16 taken 1 time.
✗ Branch 15 → 17 not taken.
 1 if (first_byte == 0xE9)
1082 {
1083 1 jmp_target = detail::decode_e9_rel32(slot_value);
1084 }
1085 else
1086 {
1087 ✗ jmp_target = detail::decode_eb_rel8(slot_value);
1088 }
1089
1/2
✗ Branch 19 → 20 not taken.
✓ Branch 19 → 21 taken 1 time.
 1 if (!jmp_target)
1090 {
1091 ✗ return false;
1092 }
1093 2 if (GetModuleHandleExW(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS |
1094 GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT,
1095
1/2
✗ Branch 23 → 24 not taken.
✓ Branch 23 → 25 taken 1 time.
 1 reinterpret_cast<LPCWSTR>(*jmp_target), &jmp_module) == 0)
1096 {
1097 ✗ return false;
1098 }
1099
1/2
✓ Branch 25 → 26 taken 1 time.
✗ Branch 25 → 27 not taken.
 1 if (slot_module == jmp_module)
1100 {
1101 1 return false;
1102 }
1103 }
1104
1105 1 return true;
1106 }
1107
1108 32 std::expected<void, HookError> HookManager::remove_hook(std::string_view hook_id)
1109 {
1110 // Non-locking fast-fail before acquiring the mutator gate.
1111
1/2
✗ Branch 3 → 4 not taken.
✓ Branch 3 → 9 taken 32 times.
 32 if (m_shutdown_called.load(std::memory_order_acquire))
1112 {
1113 ✗ m_logger.warning("HookManager: Shutdown in progress. Cannot remove hook '{}'.", hook_id);
1114 ✗ return std::unexpected(HookError::ShutdownInProgress);
1115 }
1116 // Fail closed on a reentrant call from inside a with_*/try_with_* callback: it holds m_hooks_mutex shared, so
1117 // re-acquiring this non-recursive lock here is UB / deadlock. Defer the mutation past the callback.
1118
2/2
✓ Branch 10 → 11 taken 1 time.
✓ Branch 10 → 16 taken 31 times.
 32 if (get_reentrancy_guard() > 0)
1119 {
1120
1/2
✓ Branch 11 → 12 taken 1 time.
✗ Branch 11 → 53 not taken.
 1 m_logger.warning(
1121 "HookManager: Reentrant remove_hook('{}') from within a with_*/try_with_* callback rejected; "
1122 "defer hook mutation until the callback returns.",
1123 hook_id);
1124 1 return std::unexpected(HookError::ReentrantCallRejected);
1125 }
1126
1127 // Captured in the exclusive erase phase below so the post-lock lifecycle emit can report the real hook flavor
1128 // and fire only when a hook was actually erased.
1129 31 std::string lifecycle_name;
1130 31 Diagnostics::HookKind lifecycle_kind = Diagnostics::HookKind::Inline;
1131 31 bool lifecycle_found = false;
1132
1133 31 auto [result, deferred_logs] = [&]() -> std::pair<std::expected<void, HookError>, std::vector<DeferredLogEntry>>
1134 {
1135 31 std::shared_lock<detail::SrwSharedMutex> mutator_gate(m_mutator_gate);
1136
1137 // Re-check after acquiring the gate. A thread can observe shutdown as false above, then block here behind
1138 // remove_all_hooks()'s exclusive gate; once that releases (with m_shutdown_called reset to false) this
1139 // would otherwise proceed against freshly reset reusable state. The post-gate re-check makes remove uniform
1140 // with create/enable/disable.
1141
1/2
✗ Branch 4 → 5 not taken.
✓ Branch 4 → 19 taken 31 times.
 31 if (m_shutdown_called.load(std::memory_order_acquire))
1142 {
1143 ✗ return {std::unexpected(HookError::ShutdownInProgress),
1144 {{std::format("HookManager: Shutdown in progress. Cannot remove hook '{}'.", hook_id),
1145 ✗ LogLevel::Warning}}};
1146 }
1147
1148 // Two-phase removal: disable under the shared lock first, then take the exclusive lock to erase. The shared
1149 // phase lets the kit's own with_inline_hook readers (shared_lock holders) finish before the Hook is
1150 // destroyed; SafetyHook's disable()/destructor relocates only threads that fault in the bytes being
1151 // rewritten (via a vectored exception handler; no thread is suspended), not threads already in the detour
1152 // or trampoline body. Sequencing disable() before the exclusive clear also keeps SafetyHook's own
1153 // page-reprotect-and-relocate unpatch work off the exclusive lock. The caller must ensure no thread is
1154 // executing the hooked function during removal to close the residual narrow window.
1155 {
1156 31 std::shared_lock<detail::SrwSharedMutex> shared(m_hooks_mutex);
1157
1/2
✓ Branch 20 → 21 taken 31 times.
✗ Branch 20 → 135 not taken.
 31 auto it = m_hooks.find(hook_id);
1158
2/2
✓ Branch 23 → 24 taken 7 times.
✓ Branch 23 → 38 taken 24 times.
 31 if (it == m_hooks.end())
1159 {
1160 7 return {std::unexpected(HookError::HookNotFound),
1161 {{std::format("HookManager: Attempted to remove hook with ID '{}', but it was not found.",
1162 hook_id),
1163
3/6
✓ Branch 28 → 29 taken 7 times.
✗ Branch 28 → 114 not taken.
✓ Branch 33 → 34 taken 7 times.
✓ Branch 33 → 35 taken 7 times.
✗ Branch 118 → 119 not taken.
✗ Branch 118 → 120 not taken.
 21 LogLevel::Warning}}};
1164 }
1165
1/2
✓ Branch 40 → 41 taken 24 times.
✗ Branch 40 → 134 not taken.
 24 (void)it->second->disable();
1166
2/2
✓ Branch 43 → 44 taken 24 times.
✓ Branch 43 → 46 taken 7 times.
 31 }
1167
1168
1/2
✓ Branch 45 → 47 taken 24 times.
✗ Branch 45 → 172 not taken.
 24 std::unique_lock<detail::SrwSharedMutex> lock(m_hooks_mutex);
1169 24 std::vector<DeferredLogEntry> logs;
1170
1/2
✓ Branch 47 → 48 taken 24 times.
✗ Branch 47 → 168 not taken.
 24 auto it = m_hooks.find(hook_id);
1171
1/2
✗ Branch 50 → 51 not taken.
✓ Branch 50 → 65 taken 24 times.
 24 if (it == m_hooks.end())
1172 {
1173 // The hook existed under the shared phase above but a concurrent removal erased it before this
1174 // exclusive erase phase. Report not-found rather than a false success.
1175 ✗ return {std::unexpected(HookError::HookNotFound),
1176 {{std::format("HookManager: Hook '{}' was concurrently removed before this removal completed.",
1177 hook_id),
1178 ✗ LogLevel::Warning}}};
1179 }
1180
1/2
✓ Branch 68 → 69 taken 24 times.
✗ Branch 68 → 168 not taken.
 24 std::string name_of_removed_hook = it->second->get_name();
1181 24 HookType type_of_removed_hook = it->second->get_type();
1182
1/2
✓ Branch 72 → 73 taken 24 times.
✗ Branch 72 → 166 not taken.
 24 lifecycle_name = name_of_removed_hook;
1183 24 lifecycle_kind = to_diagnostics_hook_kind(type_of_removed_hook);
1184 24 lifecycle_found = true;
1185
1/2
✓ Branch 74 → 75 taken 24 times.
✗ Branch 74 → 166 not taken.
 24 m_hooks.erase(it);
1186
1/2
✓ Branch 75 → 76 taken 24 times.
✗ Branch 75 → 166 not taken.
 24 std::erase(m_hook_creation_order, name_of_removed_hook);
1187 24 logs.push_back(
1188 {std::format("HookManager: Hook '{}' of type '{}' has been removed and unhooked.", name_of_removed_hook,
1189 24 (type_of_removed_hook == HookType::Inline ? "Inline" : "Mid")),
1190 LogLevel::Debug});
1191 24 return {std::expected<void, HookError>{}, std::move(logs)};
1192
8/42
✗ Branch 6 → 7 not taken.
✗ Branch 6 → 104 not taken.
✗ Branch 16 → 17 not taken.
✗ Branch 16 → 18 not taken.
✓ Branch 17 → 18 taken 31 times.
✗ Branch 17 → 54 not taken.
✓ Branch 25 → 26 taken 7 times.
✗ Branch 25 → 124 not taken.
✗ Branch 35 → 36 not taken.
✓ Branch 35 → 37 taken 7 times.
✗ Branch 52 → 53 not taken.
✗ Branch 52 → 148 not taken.
✗ Branch 62 → 63 not taken.
✗ Branch 62 → 64 not taken.
✓ Branch 76 → 77 taken 18 times.
✓ Branch 76 → 78 taken 6 times.
✓ Branch 79 → 80 taken 24 times.
✗ Branch 79 → 163 not taken.
✓ Branch 80 → 81 taken 24 times.
✗ Branch 80 → 158 not taken.
✗ Branch 82 → 83 not taken.
✓ Branch 82 → 84 taken 24 times.
✗ Branch 101 → 102 not taken.
✗ Branch 101 → 103 not taken.
✗ Branch 105 → 106 not taken.
✗ Branch 105 → 109 not taken.
✗ Branch 107 → 108 not taken.
✗ Branch 107 → 109 not taken.
✗ Branch 121 → 122 not taken.
✗ Branch 121 → 123 not taken.
✗ Branch 125 → 126 not taken.
✗ Branch 125 → 129 not taken.
✗ Branch 127 → 128 not taken.
✗ Branch 127 → 129 not taken.
✗ Branch 145 → 146 not taken.
✗ Branch 145 → 147 not taken.
✗ Branch 149 → 150 not taken.
✗ Branch 149 → 153 not taken.
✗ Branch 151 → 152 not taken.
✗ Branch 151 → 153 not taken.
✗ Branch 160 → 161 not taken.
✗ Branch 160 → 162 not taken.
 148 }();
1193
1194 // Emit collected messages after all hook locks are released (deferred logging keeps the Logger's own locks off
1195 // this module's critical sections).
1196
2/2
✓ Branch 35 → 22 taken 31 times.
✓ Branch 35 → 36 taken 31 times.
 93 for (const auto &entry : deferred_logs)
1197 {
1198
1/2
✓ Branch 25 → 26 taken 31 times.
✗ Branch 25 → 55 not taken.
 31 m_logger.log(entry.level, entry.msg);
1199 }
1200
5/6
✓ Branch 36 → 37 taken 24 times.
✓ Branch 36 → 40 taken 7 times.
✓ Branch 38 → 39 taken 24 times.
✗ Branch 38 → 40 not taken.
✓ Branch 41 → 42 taken 24 times.
✓ Branch 41 → 44 taken 7 times.
 31 if (lifecycle_found && result)
1201 {
1202 24 emit_hook_lifecycle(lifecycle_name, lifecycle_kind, Diagnostics::HookTransition::Removed);
1203 }
1204 31 return result;
1205
1/4
✗ Branch 44 → 45 not taken.
✓ Branch 44 → 46 taken 31 times.
✗ Branch 56 → 57 not taken.
✗ Branch 56 → 58 not taken.
 93 }
1206
1207 413 void HookManager::remove_all_hooks() noexcept
1208 {
1209
2/2
✓ Branch 3 → 4 taken 1 time.
✓ Branch 3 → 6 taken 412 times.
 413 if (get_reentrancy_guard() > 0)
1210 {
1211 // remove_all_hooks() is noexcept; route the misuse diagnostic through the no-throw try_log so a sink or
1212 // format failure cannot escape the rejected reentrant call.
1213 1 (void)m_logger.try_log(LogLevel::Warning,
1214 "HookManager: Reentrant remove_all_hooks() from within a with_*/try_with_* callback "
1215 "rejected; defer hook teardown until the callback returns.");
1216 1 return;
1217 }
1218
1219 // Serialize with shutdown() via compare_exchange_strong. Only one teardown owner proceeds.
1220 412 bool expected = false;
1221
1/2
✗ Branch 7 → 8 not taken.
✓ Branch 7 → 9 taken 412 times.
 412 if (!m_shutdown_called.compare_exchange_strong(expected, true, std::memory_order_acq_rel))
1222 ✗ return;
1223
1224 412 size_t num_vmt = 0;
1225 412 size_t num_hooks = 0;
1226 {
1227 // Block all mutators (create_*_hook, enable, disable, remove) before entering phase 1. They hold shared on
1228 // m_mutator_gate, so acquiring exclusive here waits for active mutators and blocks new ones.
1229 412 std::unique_lock<detail::SrwSharedMutex> mutator_gate(m_mutator_gate);
1230
1231 // Two-phase removal: disable hooks under the shared lock first, then take the exclusive lock to erase. The
1232 // shared phase lets the kit's own with_inline_hook readers (shared_lock holders) finish before the Hook is
1233 // destroyed; SafetyHook relocates only threads caught in the patched prologue, not threads already in the
1234 // detour or trampoline body, so the caller must quiesce the hooked function during teardown to close the
1235 // residual narrow window.
1236 {
1237 412 std::shared_lock<detail::SrwSharedMutex> shared(m_hooks_mutex);
1238 412 disable_hooks_reverse_order_locked();
1239 412 }
1240
1241 412 std::unique_lock<detail::SrwSharedMutex> lock(m_hooks_mutex);
1242
1243 412 num_vmt = m_vmt_hooks.size();
1244 412 clear_vmt_hooks_locked();
1245
1246 412 num_hooks = m_hooks.size();
1247 412 clear_hooks_locked();
1248
1249 // Reset under the lock so concurrent create_*_hook calls cannot observe the flag as true (rejected) and
1250 // then immediately see it as false (accepted) before the maps are fully cleared. Both locks are released
1251 // when this block exits, letting new mutators proceed against a fresh m_shutdown_called == false.
1252 412 m_shutdown_called.store(false, std::memory_order_release);
1253 412 }
1254
1255 // Emit the teardown logs only after the hooks mutex and the mutator gate are both released, so the logger's
1256 // sink I/O never extends either critical section (deferred-logging convention, matching the create_*_hook
1257 // paths). remove_all_hooks() is noexcept, so each summary line goes through the no-throw try_log path.
1258
2/2
✓ Branch 21 → 22 taken 2 times.
✓ Branch 21 → 24 taken 410 times.
 412 if (num_vmt > 0)
1259 {
1260 2 (void)m_logger.try_log(LogLevel::Debug, "HookManager: Removed all {} VMT hooks.", num_vmt);
1261 }
1262
2/2
✓ Branch 24 → 25 taken 70 times.
✓ Branch 24 → 27 taken 342 times.
 412 if (num_hooks > 0)
1263 {
1264 70 (void)m_logger.try_log(LogLevel::Debug, "HookManager: Removed all {} managed hooks and unhooked them.",
1265 num_hooks);
1266 }
1267
2/2
✓ Branch 27 → 28 taken 340 times.
✓ Branch 27 → 30 taken 2 times.
 342 else if (num_vmt == 0)
1268 {
1269 340 (void)m_logger.try_log(LogLevel::Debug,
1270 "HookManager: remove_all_hooks called, but no hooks were active to remove.");
1271 }
1272 }
1273
1274 454 std::expected<void, HookError> HookManager::enable_hook(std::string_view hook_id)
1275 {
1276
1/2
✗ Branch 3 → 4 not taken.
✓ Branch 3 → 9 taken 454 times.
 454 if (m_shutdown_called.load(std::memory_order_acquire))
1277 {
1278 ✗ m_logger.warning("HookManager: Shutdown in progress. Cannot enable hook '{}'.", hook_id);
1279 ✗ return std::unexpected(HookError::ShutdownInProgress);
1280 }
1281 // Fail closed on a reentrant call from inside a with_*/try_with_* callback: it holds m_hooks_mutex shared, so
1282 // re-acquiring this non-recursive lock here is UB / deadlock. Defer the mutation past the callback.
1283
2/2
✓ Branch 10 → 11 taken 1 time.
✓ Branch 10 → 16 taken 453 times.
 454 if (get_reentrancy_guard() > 0)
1284 {
1285
1/2
✓ Branch 11 → 12 taken 1 time.
✗ Branch 11 → 46 not taken.
 1 m_logger.warning(
1286 "HookManager: Reentrant enable_hook('{}') from within a with_*/try_with_* callback rejected; "
1287 "defer hook mutation until the callback returns.",
1288 hook_id);
1289 1 return std::unexpected(HookError::ReentrantCallRejected);
1290 }
1291
1292 // Captured in the locked lookup below so the post-lock lifecycle emit can report the real hook flavor and fire
1293 // only when the operation actually changes the hook state.
1294 453 Diagnostics::HookKind lifecycle_kind = Diagnostics::HookKind::Inline;
1295 453 bool lifecycle_transitioned = false;
1296
1297 452 auto [result, deferred_logs] = [&]() -> std::pair<std::expected<void, HookError>, std::vector<DeferredLogEntry>>
1298 {
1299 453 std::shared_lock<detail::SrwSharedMutex> mutator_gate(m_mutator_gate);
1300 452 std::shared_lock<detail::SrwSharedMutex> lock(m_hooks_mutex);
1301
1/2
✗ Branch 5 → 6 not taken.
✓ Branch 5 → 20 taken 453 times.
 453 if (m_shutdown_called.load(std::memory_order_acquire))
1302 {
1303 ✗ return {std::unexpected(HookError::ShutdownInProgress),
1304 {{std::format("HookManager: Shutdown in progress. Cannot enable hook '{}'.", hook_id),
1305 ✗ LogLevel::Warning}}};
1306 }
1307
1/2
✓ Branch 20 → 21 taken 453 times.
✗ Branch 20 → 201 not taken.
 453 auto it = m_hooks.find(hook_id);
1308
2/2
✓ Branch 23 → 24 taken 43 times.
✓ Branch 23 → 38 taken 409 times.
 453 if (it == m_hooks.end())
1309 {
1310 43 return {std::unexpected(HookError::HookNotFound),
1311 {{std::format("HookManager: Hook ID '{}' not found for enable operation.", hook_id),
1312
3/6
✓ Branch 28 → 29 taken 44 times.
✗ Branch 28 → 122 not taken.
✓ Branch 33 → 34 taken 42 times.
✓ Branch 33 → 35 taken 44 times.
✗ Branch 126 → 127 not taken.
✗ Branch 126 → 128 not taken.
 128 LogLevel::Warning}}};
1313 }
1314
1315 409 Hook *hook = it->second.get();
1316 409 lifecycle_kind = to_diagnostics_hook_kind(hook->get_type());
1317 409 const HookStatus status_before = hook->get_status();
1318
1/2
✓ Branch 43 → 44 taken 408 times.
✗ Branch 43 → 201 not taken.
 409 auto enable_result = hook->enable();
1319
4/4
✓ Branch 45 → 46 taken 72 times.
✓ Branch 45 → 48 taken 336 times.
✓ Branch 46 → 47 taken 55 times.
✓ Branch 46 → 48 taken 17 times.
 408 lifecycle_transitioned = enable_result.has_value() && status_before == HookStatus::Disabled;
1320
2/2
✓ Branch 50 → 51 taken 72 times.
✓ Branch 50 → 65 taken 336 times.
 408 if (enable_result)
1321 {
1322 72 return {std::expected<void, HookError>{},
1323
3/6
✓ Branch 55 → 56 taken 72 times.
✗ Branch 55 → 142 not taken.
✓ Branch 60 → 61 taken 72 times.
✓ Branch 60 → 62 taken 72 times.
✗ Branch 146 → 147 not taken.
✗ Branch 146 → 148 not taken.
 215 {{std::format("HookManager: Hook '{}' successfully enabled.", hook_id), LogLevel::Debug}}};
1324 }
1325
1326 336 const auto error = enable_result.error();
1327
1/2
✓ Branch 66 → 67 taken 336 times.
✗ Branch 66 → 83 not taken.
 336 if (error == HookError::InvalidHookState)
1328 {
1329 336 return {std::unexpected(error),
1330 {{std::format("HookManager: Hook '{}' cannot be enabled. Current status: {}", hook_id,
1331 336 Hook::status_to_string(hook->get_status())),
1332
3/6
✓ Branch 73 → 74 taken 337 times.
✗ Branch 73 → 161 not taken.
✓ Branch 78 → 79 taken 337 times.
✓ Branch 78 → 80 taken 337 times.
✗ Branch 165 → 166 not taken.
✗ Branch 165 → 167 not taken.
 1011 LogLevel::Warning}}};
1333 }
1334 ✗ return {std::unexpected(error),
1335 ✗ {{std::format("HookManager: Failed to enable hook '{}': {}", hook_id, Hook::error_to_string(error)),
1336 ✗ LogLevel::Error}}};
1337
7/52
✗ Branch 7 → 8 not taken.
✗ Branch 7 → 112 not taken.
✓ Branch 16 → 17 taken 452 times.
✗ Branch 16 → 47 not taken.
✗ Branch 17 → 18 not taken.
✗ Branch 17 → 19 not taken.
✓ Branch 25 → 26 taken 44 times.
✗ Branch 25 → 132 not taken.
✗ Branch 35 → 36 not taken.
✓ Branch 35 → 37 taken 44 times.
✓ Branch 52 → 53 taken 71 times.
✗ Branch 52 → 152 not taken.
✗ Branch 62 → 63 not taken.
✓ Branch 62 → 64 taken 72 times.
✓ Branch 70 → 71 taken 337 times.
✗ Branch 70 → 171 not taken.
✗ Branch 80 → 81 not taken.
✓ Branch 80 → 82 taken 337 times.
✗ Branch 85 → 86 not taken.
✗ Branch 85 → 191 not taken.
✗ Branch 95 → 96 not taken.
✗ Branch 95 → 97 not taken.
✗ Branch 109 → 110 not taken.
✗ Branch 109 → 111 not taken.
✗ Branch 113 → 114 not taken.
✗ Branch 113 → 117 not taken.
✗ Branch 115 → 116 not taken.
✗ Branch 115 → 117 not taken.
✗ Branch 129 → 130 not taken.
✗ Branch 129 → 131 not taken.
✗ Branch 133 → 134 not taken.
✗ Branch 133 → 137 not taken.
✗ Branch 135 → 136 not taken.
✗ Branch 135 → 137 not taken.
✗ Branch 149 → 150 not taken.
✗ Branch 149 → 151 not taken.
✗ Branch 153 → 154 not taken.
✗ Branch 153 → 157 not taken.
✗ Branch 155 → 156 not taken.
✗ Branch 155 → 157 not taken.
✗ Branch 168 → 169 not taken.
✗ Branch 168 → 170 not taken.
✗ Branch 173 → 174 not taken.
✗ Branch 173 → 177 not taken.
✗ Branch 175 → 176 not taken.
✗ Branch 175 → 177 not taken.
✗ Branch 188 → 189 not taken.
✗ Branch 188 → 190 not taken.
✗ Branch 193 → 194 not taken.
✗ Branch 193 → 197 not taken.
✗ Branch 195 → 196 not taken.
✗ Branch 195 → 197 not taken.
 1693 }();
1338
1339 // Emit after releasing the gate and hook lock (deferred logging).
1340
2/2
✓ Branch 34 → 21 taken 450 times.
✓ Branch 34 → 35 taken 453 times.
 1356 for (const auto &entry : deferred_logs)
1341 {
1342
1/2
✓ Branch 24 → 25 taken 453 times.
✗ Branch 24 → 48 not taken.
 450 m_logger.log(entry.level, entry.msg);
1343 }
1344
2/2
✓ Branch 35 → 36 taken 55 times.
✓ Branch 35 → 37 taken 398 times.
 453 if (lifecycle_transitioned)
1345 {
1346 55 emit_hook_lifecycle(hook_id, lifecycle_kind, Diagnostics::HookTransition::Enabled);
1347 }
1348 453 return result;
1349
1/4
✗ Branch 37 → 38 not taken.
✓ Branch 37 → 39 taken 453 times.
✗ Branch 49 → 50 not taken.
✗ Branch 49 → 51 not taken.
 906 }
1350
1351 456 std::expected<void, HookError> HookManager::disable_hook(std::string_view hook_id)
1352 {
1353
1/2
✗ Branch 3 → 4 not taken.
✓ Branch 3 → 9 taken 455 times.
 456 if (m_shutdown_called.load(std::memory_order_acquire))
1354 {
1355 ✗ m_logger.warning("HookManager: Shutdown in progress. Cannot disable hook '{}'.", hook_id);
1356 ✗ return std::unexpected(HookError::ShutdownInProgress);
1357 }
1358 // Fail closed on a reentrant call from inside a with_*/try_with_* callback: it holds m_hooks_mutex shared, so
1359 // re-acquiring this non-recursive lock here is UB / deadlock. Defer the mutation past the callback.
1360
2/2
✓ Branch 10 → 11 taken 1 time.
✓ Branch 10 → 16 taken 455 times.
 455 if (get_reentrancy_guard() > 0)
1361 {
1362
1/2
✓ Branch 11 → 12 taken 1 time.
✗ Branch 11 → 46 not taken.
 1 m_logger.warning(
1363 "HookManager: Reentrant disable_hook('{}') from within a with_*/try_with_* callback rejected; "
1364 "defer hook mutation until the callback returns.",
1365 hook_id);
1366 1 return std::unexpected(HookError::ReentrantCallRejected);
1367 }
1368
1369 // Captured in the locked lookup below so the post-lock lifecycle emit can report the real hook flavor and fire
1370 // only when the operation actually changes the hook state.
1371 455 Diagnostics::HookKind lifecycle_kind = Diagnostics::HookKind::Inline;
1372 455 bool lifecycle_transitioned = false;
1373
1374 455 auto [result, deferred_logs] = [&]() -> std::pair<std::expected<void, HookError>, std::vector<DeferredLogEntry>>
1375 {
1376 455 std::shared_lock<detail::SrwSharedMutex> mutator_gate(m_mutator_gate);
1377 454 std::shared_lock<detail::SrwSharedMutex> lock(m_hooks_mutex);
1378
1/2
✗ Branch 5 → 6 not taken.
✓ Branch 5 → 20 taken 455 times.
 455 if (m_shutdown_called.load(std::memory_order_acquire))
1379 {
1380 ✗ return {std::unexpected(HookError::ShutdownInProgress),
1381 {{std::format("HookManager: Shutdown in progress. Cannot disable hook '{}'.", hook_id),
1382 ✗ LogLevel::Warning}}};
1383 }
1384
1/2
✓ Branch 20 → 21 taken 455 times.
✗ Branch 20 → 201 not taken.
 455 auto it = m_hooks.find(hook_id);
1385
2/2
✓ Branch 23 → 24 taken 44 times.
✓ Branch 23 → 38 taken 411 times.
 455 if (it == m_hooks.end())
1386 {
1387 44 return {std::unexpected(HookError::HookNotFound),
1388 {{std::format("HookManager: Hook ID '{}' not found for disable operation.", hook_id),
1389
3/6
✓ Branch 28 → 29 taken 44 times.
✗ Branch 28 → 122 not taken.
✓ Branch 33 → 34 taken 44 times.
✓ Branch 33 → 35 taken 44 times.
✗ Branch 126 → 127 not taken.
✗ Branch 126 → 128 not taken.
 132 LogLevel::Warning}}};
1390 }
1391
1392 411 Hook *hook = it->second.get();
1393 411 lifecycle_kind = to_diagnostics_hook_kind(hook->get_type());
1394 411 const HookStatus status_before = hook->get_status();
1395
1/2
✓ Branch 43 → 44 taken 411 times.
✗ Branch 43 → 201 not taken.
 411 auto disable_result = hook->disable();
1396
4/4
✓ Branch 45 → 46 taken 71 times.
✓ Branch 45 → 48 taken 339 times.
✓ Branch 46 → 47 taken 58 times.
✓ Branch 46 → 48 taken 13 times.
 411 lifecycle_transitioned = disable_result.has_value() && status_before == HookStatus::Active;
1397
2/2
✓ Branch 50 → 51 taken 71 times.
✓ Branch 50 → 65 taken 339 times.
 410 if (disable_result)
1398 {
1399 71 return {std::expected<void, HookError>{},
1400
3/6
✓ Branch 55 → 56 taken 71 times.
✗ Branch 55 → 142 not taken.
✓ Branch 60 → 61 taken 71 times.
✓ Branch 60 → 62 taken 71 times.
✗ Branch 146 → 147 not taken.
✗ Branch 146 → 148 not taken.
 213 {{std::format("HookManager: Hook '{}' successfully disabled.", hook_id), LogLevel::Debug}}};
1401 }
1402
1403 339 const auto error = disable_result.error();
1404
1/2
✓ Branch 66 → 67 taken 339 times.
✗ Branch 66 → 83 not taken.
 339 if (error == HookError::InvalidHookState)
1405 {
1406 339 return {std::unexpected(error),
1407 {{std::format("HookManager: Hook '{}' cannot be disabled. Current status: {}", hook_id,
1408 339 Hook::status_to_string(hook->get_status())),
1409
3/6
✓ Branch 73 → 74 taken 340 times.
✗ Branch 73 → 161 not taken.
✓ Branch 78 → 79 taken 339 times.
✓ Branch 78 → 80 taken 340 times.
✗ Branch 165 → 166 not taken.
✗ Branch 165 → 167 not taken.
 1017 LogLevel::Warning}}};
1410 }
1411 return {
1412 ✗ std::unexpected(error),
1413 ✗ {{std::format("HookManager: Failed to disable hook '{}': {}", hook_id, Hook::error_to_string(error)),
1414 ✗ LogLevel::Error}}};
1415
7/52
✗ Branch 7 → 8 not taken.
✗ Branch 7 → 112 not taken.
✓ Branch 16 → 17 taken 455 times.
✗ Branch 16 → 47 not taken.
✗ Branch 17 → 18 not taken.
✗ Branch 17 → 19 not taken.
✓ Branch 25 → 26 taken 44 times.
✗ Branch 25 → 132 not taken.
✗ Branch 35 → 36 not taken.
✓ Branch 35 → 37 taken 44 times.
✓ Branch 52 → 53 taken 71 times.
✗ Branch 52 → 152 not taken.
✗ Branch 62 → 63 not taken.
✓ Branch 62 → 64 taken 71 times.
✓ Branch 70 → 71 taken 339 times.
✗ Branch 70 → 171 not taken.
✗ Branch 80 → 81 not taken.
✓ Branch 80 → 82 taken 340 times.
✗ Branch 85 → 86 not taken.
✗ Branch 85 → 191 not taken.
✗ Branch 95 → 96 not taken.
✗ Branch 95 → 97 not taken.
✗ Branch 109 → 110 not taken.
✗ Branch 109 → 111 not taken.
✗ Branch 113 → 114 not taken.
✗ Branch 113 → 117 not taken.
✗ Branch 115 → 116 not taken.
✗ Branch 115 → 117 not taken.
✗ Branch 129 → 130 not taken.
✗ Branch 129 → 131 not taken.
✗ Branch 133 → 134 not taken.
✗ Branch 133 → 137 not taken.
✗ Branch 135 → 136 not taken.
✗ Branch 135 → 137 not taken.
✗ Branch 149 → 150 not taken.
✗ Branch 149 → 151 not taken.
✗ Branch 153 → 154 not taken.
✗ Branch 153 → 157 not taken.
✗ Branch 155 → 156 not taken.
✗ Branch 155 → 157 not taken.
✗ Branch 168 → 169 not taken.
✗ Branch 168 → 170 not taken.
✗ Branch 173 → 174 not taken.
✗ Branch 173 → 177 not taken.
✗ Branch 175 → 176 not taken.
✗ Branch 175 → 177 not taken.
✗ Branch 188 → 189 not taken.
✗ Branch 188 → 190 not taken.
✗ Branch 193 → 194 not taken.
✗ Branch 193 → 197 not taken.
✗ Branch 195 → 196 not taken.
✗ Branch 195 → 197 not taken.
 1704 }();
1416
1417 // Emit after releasing the gate and hook lock (deferred logging).
1418
2/2
✓ Branch 34 → 21 taken 455 times.
✓ Branch 34 → 35 taken 455 times.
 1365 for (const auto &entry : deferred_logs)
1419 {
1420
1/2
✓ Branch 24 → 25 taken 455 times.
✗ Branch 24 → 48 not taken.
 455 m_logger.log(entry.level, entry.msg);
1421 }
1422
2/2
✓ Branch 35 → 36 taken 58 times.
✓ Branch 35 → 37 taken 397 times.
 455 if (lifecycle_transitioned)
1423 {
1424 58 emit_hook_lifecycle(hook_id, lifecycle_kind, Diagnostics::HookTransition::Disabled);
1425 }
1426 455 return result;
1427
1/4
✗ Branch 37 → 38 not taken.
✓ Branch 37 → 39 taken 455 times.
✗ Branch 49 → 50 not taken.
✗ Branch 49 → 51 not taken.
 910 }
1428
1429 14 bool HookManager::toggle_hook_locked(std::string_view hook_id, Hook &hook, bool enable,
1430 std::vector<DeferredLogEntry> &logs)
1431 {
1432
4/6
✓ Branch 2 → 3 taken 5 times.
✓ Branch 2 → 4 taken 9 times.
✓ Branch 3 → 5 taken 5 times.
✗ Branch 3 → 60 not taken.
✓ Branch 4 → 5 taken 9 times.
✗ Branch 4 → 60 not taken.
 14 auto result = enable ? hook.enable() : hook.disable();
1433 // "enable" + 'd' / "disable" + 'd' reads as "enabled" / "disabled" in the log.
1434
2/2
✓ Branch 5 → 6 taken 5 times.
✓ Branch 5 → 7 taken 9 times.
 14 const std::string_view verb = enable ? "enable" : "disable";
1435
1/2
✓ Branch 10 → 11 taken 14 times.
✗ Branch 10 → 17 not taken.
 14 if (result)
1436 {
1437 14 logs.push_back({std::format("HookManager: Hook '{}' successfully {}d.", hook_id, verb), LogLevel::Debug});
1438 14 return true;
1439 }
1440
1441 ✗ const auto error = result.error();
1442 ✗ if (error == HookError::InvalidHookState)
1443 {
1444 ✗ logs.push_back({std::format("HookManager: Hook '{}' cannot be {}d. Current status: {}", hook_id, verb,
1445 ✗ Hook::status_to_string(hook.get_status())),
1446 LogLevel::Warning});
1447 }
1448 else
1449 {
1450 ✗ logs.push_back(
1451 ✗ {std::format("HookManager: Failed to {} hook '{}': {}", verb, hook_id, Hook::error_to_string(error)),
1452 LogLevel::Error});
1453 }
1454 ✗ return false;
1455
3/24
✓ Branch 11 → 12 taken 14 times.
✗ Branch 11 → 42 not taken.
✓ Branch 12 → 13 taken 14 times.
✗ Branch 12 → 37 not taken.
✗ Branch 14 → 15 not taken.
✓ Branch 14 → 16 taken 14 times.
✗ Branch 21 → 22 not taken.
✗ Branch 21 → 49 not taken.
✗ Branch 22 → 23 not taken.
✗ Branch 22 → 44 not taken.
✗ Branch 24 → 25 not taken.
✗ Branch 24 → 26 not taken.
✗ Branch 28 → 29 not taken.
✗ Branch 28 → 57 not taken.
✗ Branch 29 → 30 not taken.
✗ Branch 29 → 52 not taken.
✗ Branch 31 → 32 not taken.
✗ Branch 31 → 33 not taken.
✗ Branch 39 → 40 not taken.
✗ Branch 39 → 41 not taken.
✗ Branch 46 → 47 not taken.
✗ Branch 46 → 48 not taken.
✗ Branch 54 → 55 not taken.
✗ Branch 54 → 56 not taken.
 28 }
1456
1457 4 std::size_t HookManager::enable_hooks(std::span<const std::string_view> hook_ids)
1458 {
1459
1/2
✗ Branch 3 → 4 not taken.
✓ Branch 3 → 7 taken 4 times.
 4 if (m_shutdown_called.load(std::memory_order_acquire))
1460 {
1461 ✗ m_logger.warning("HookManager: Shutdown in progress. Cannot enable {} hook(s).", hook_ids.size());
1462 ✗ return 0;
1463 }
1464 // Fail closed on a reentrant call from inside a with_*/try_with_* callback: it holds m_hooks_mutex shared, so
1465 // re-acquiring this non-recursive lock here is UB / deadlock. Defer the mutation past the callback.
1466
2/2
✓ Branch 8 → 9 taken 1 time.
✓ Branch 8 → 11 taken 3 times.
 4 if (get_reentrancy_guard() > 0)
1467 {
1468
1/2
✓ Branch 9 → 10 taken 1 time.
✗ Branch 9 → 40 not taken.
 1 m_logger.error(
1469 "HookManager: Reentrant enable_hooks() from within a with_*/try_with_* callback rejected; defer "
1470 "hook mutation until the callback returns.");
1471 1 return 0;
1472 }
1473
1474 3 auto [enabled, deferred_logs] = [&]() -> std::pair<std::size_t, std::vector<DeferredLogEntry>>
1475 {
1476 3 std::vector<DeferredLogEntry> logs;
1477 3 std::shared_lock<detail::SrwSharedMutex> mutator_gate(m_mutator_gate);
1478 3 std::shared_lock<detail::SrwSharedMutex> lock(m_hooks_mutex);
1479
1/2
✗ Branch 5 → 6 not taken.
✓ Branch 5 → 16 taken 3 times.
 3 if (m_shutdown_called.load(std::memory_order_acquire))
1480 {
1481 ✗ logs.push_back(
1482 ✗ {std::format("HookManager: Shutdown in progress. Cannot enable {} hook(s).", hook_ids.size()),
1483 LogLevel::Warning});
1484 ✗ return {0, std::move(logs)};
1485 }
1486
1487 3 std::size_t count = 0;
1488
2/2
✓ Branch 45 → 18 taken 3 times.
✓ Branch 45 → 46 taken 3 times.
 9 for (const std::string_view hook_id : hook_ids)
1489 {
1490
1/2
✓ Branch 20 → 21 taken 3 times.
✗ Branch 20 → 69 not taken.
 3 auto it = m_hooks.find(hook_id);
1491
1/2
✗ Branch 23 → 24 not taken.
✓ Branch 23 → 30 taken 3 times.
 3 if (it == m_hooks.end())
1492 {
1493 ✗ logs.push_back({std::format("HookManager: Hook ID '{}' not found for enable operation.", hook_id),
1494 LogLevel::Warning});
1495 ✗ continue;
1496 }
1497
2/4
✓ Branch 32 → 33 taken 3 times.
✗ Branch 32 → 69 not taken.
✓ Branch 33 → 34 taken 3 times.
✗ Branch 33 → 35 not taken.
 3 if (toggle_hook_locked(hook_id, *it->second, true, logs))
1498 {
1499 3 ++count;
1500 }
1501 }
1502 3 return {count, std::move(logs)};
1503
1/18
✗ Branch 7 → 8 not taken.
✗ Branch 7 → 59 not taken.
✗ Branch 8 → 9 not taken.
✗ Branch 8 → 54 not taken.
✗ Branch 10 → 11 not taken.
✗ Branch 10 → 12 not taken.
✓ Branch 11 → 12 taken 3 times.
✗ Branch 11 → 41 not taken.
✗ Branch 24 → 25 not taken.
✗ Branch 24 → 67 not taken.
✗ Branch 25 → 26 not taken.
✗ Branch 25 → 62 not taken.
✗ Branch 27 → 28 not taken.
✗ Branch 27 → 29 not taken.
✗ Branch 56 → 57 not taken.
✗ Branch 56 → 58 not taken.
✗ Branch 64 → 65 not taken.
✗ Branch 64 → 66 not taken.
 6 }();
1504
1505 // Emit after releasing the gate and hook lock (deferred logging) so a synchronous sink flush or a blocking
1506 // async overflow never stalls an exclusive acquirer inside the critical section.
1507
2/2
✓ Branch 29 → 16 taken 3 times.
✓ Branch 29 → 30 taken 3 times.
 9 for (const auto &entry : deferred_logs)
1508 {
1509
1/2
✓ Branch 19 → 20 taken 3 times.
✗ Branch 19 → 42 not taken.
 3 m_logger.log(entry.level, entry.msg);
1510 }
1511 3 return enabled;
1512
1/4
✗ Branch 30 → 31 not taken.
✓ Branch 30 → 32 taken 3 times.
✗ Branch 43 → 44 not taken.
✗ Branch 43 → 45 not taken.
 6 }
1513
1514 5 std::size_t HookManager::disable_hooks(std::span<const std::string_view> hook_ids)
1515 {
1516
1/2
✗ Branch 3 → 4 not taken.
✓ Branch 3 → 7 taken 5 times.
 5 if (m_shutdown_called.load(std::memory_order_acquire))
1517 {
1518 ✗ m_logger.warning("HookManager: Shutdown in progress. Cannot disable {} hook(s).", hook_ids.size());
1519 ✗ return 0;
1520 }
1521 // Fail closed on a reentrant call from inside a with_*/try_with_* callback: it holds m_hooks_mutex shared, so
1522 // re-acquiring this non-recursive lock here is UB / deadlock. Defer the mutation past the callback.
1523
2/2
✓ Branch 8 → 9 taken 1 time.
✓ Branch 8 → 11 taken 4 times.
 5 if (get_reentrancy_guard() > 0)
1524 {
1525
1/2
✓ Branch 9 → 10 taken 1 time.
✗ Branch 9 → 40 not taken.
 1 m_logger.error("HookManager: Reentrant disable_hooks() from within a with_*/try_with_* callback rejected; "
1526 "defer hook mutation until the callback returns.");
1527 1 return 0;
1528 }
1529
1530 4 auto [disabled, deferred_logs] = [&]() -> std::pair<std::size_t, std::vector<DeferredLogEntry>>
1531 {
1532 4 std::vector<DeferredLogEntry> logs;
1533 4 std::shared_lock<detail::SrwSharedMutex> mutator_gate(m_mutator_gate);
1534 4 std::shared_lock<detail::SrwSharedMutex> lock(m_hooks_mutex);
1535
1/2
✗ Branch 5 → 6 not taken.
✓ Branch 5 → 16 taken 4 times.
 4 if (m_shutdown_called.load(std::memory_order_acquire))
1536 {
1537 ✗ logs.push_back(
1538 ✗ {std::format("HookManager: Shutdown in progress. Cannot disable {} hook(s).", hook_ids.size()),
1539 LogLevel::Warning});
1540 ✗ return {0, std::move(logs)};
1541 }
1542
1543 4 std::size_t count = 0;
1544
2/2
✓ Branch 45 → 18 taken 8 times.
✓ Branch 45 → 46 taken 4 times.
 16 for (const std::string_view hook_id : hook_ids)
1545 {
1546
1/2
✓ Branch 20 → 21 taken 8 times.
✗ Branch 20 → 69 not taken.
 8 auto it = m_hooks.find(hook_id);
1547
2/2
✓ Branch 23 → 24 taken 1 time.
✓ Branch 23 → 30 taken 7 times.
 8 if (it == m_hooks.end())
1548 {
1549 1 logs.push_back({std::format("HookManager: Hook ID '{}' not found for disable operation.", hook_id),
1550 LogLevel::Warning});
1551 1 continue;
1552 }
1553
2/4
✓ Branch 32 → 33 taken 7 times.
✗ Branch 32 → 69 not taken.
✓ Branch 33 → 34 taken 7 times.
✗ Branch 33 → 35 not taken.
 7 if (toggle_hook_locked(hook_id, *it->second, false, logs))
1554 {
1555 7 ++count;
1556 }
1557 }
1558 4 return {count, std::move(logs)};
1559
4/18
✗ Branch 7 → 8 not taken.
✗ Branch 7 → 59 not taken.
✗ Branch 8 → 9 not taken.
✗ Branch 8 → 54 not taken.
✗ Branch 10 → 11 not taken.
✗ Branch 10 → 12 not taken.
✓ Branch 11 → 12 taken 4 times.
✗ Branch 11 → 41 not taken.
✓ Branch 24 → 25 taken 1 time.
✗ Branch 24 → 67 not taken.
✓ Branch 25 → 26 taken 1 time.
✗ Branch 25 → 62 not taken.
✗ Branch 27 → 28 not taken.
✓ Branch 27 → 29 taken 1 time.
✗ Branch 56 → 57 not taken.
✗ Branch 56 → 58 not taken.
✗ Branch 64 → 65 not taken.
✗ Branch 64 → 66 not taken.
 10 }();
1560
1561 // Emit after releasing the gate and hook lock (deferred logging) so a synchronous sink flush or a blocking
1562 // async overflow never stalls an exclusive acquirer inside the critical section.
1563
2/2
✓ Branch 29 → 16 taken 8 times.
✓ Branch 29 → 30 taken 4 times.
 16 for (const auto &entry : deferred_logs)
1564 {
1565
1/2
✓ Branch 19 → 20 taken 8 times.
✗ Branch 19 → 42 not taken.
 8 m_logger.log(entry.level, entry.msg);
1566 }
1567 4 return disabled;
1568
1/4
✗ Branch 30 → 31 not taken.
✓ Branch 30 → 32 taken 4 times.
✗ Branch 43 → 44 not taken.
✗ Branch 43 → 45 not taken.
 8 }
1569
1570 3 std::size_t HookManager::enable_all_hooks()
1571 {
1572
1/2
✗ Branch 3 → 4 not taken.
✓ Branch 3 → 6 taken 3 times.
 3 if (m_shutdown_called.load(std::memory_order_acquire))
1573 {
1574 ✗ m_logger.warning("HookManager: Shutdown in progress. Cannot enable all hooks.");
1575 ✗ return 0;
1576 }
1577 // Fail closed on a reentrant call from inside a with_*/try_with_* callback: it holds m_hooks_mutex shared, so
1578 // re-acquiring this non-recursive lock here is UB / deadlock. Defer the mutation past the callback.
1579
2/2
✓ Branch 7 → 8 taken 1 time.
✓ Branch 7 → 10 taken 2 times.
 3 if (get_reentrancy_guard() > 0)
1580 {
1581
1/2
✓ Branch 8 → 9 taken 1 time.
✗ Branch 8 → 38 not taken.
 1 m_logger.error(
1582 "HookManager: Reentrant enable_all_hooks() from within a with_*/try_with_* callback rejected; "
1583 "defer hook mutation until the callback returns.");
1584 1 return 0;
1585 }
1586
1587 2 auto [enabled, deferred_logs] = [&]() -> std::pair<std::size_t, std::vector<DeferredLogEntry>>
1588 {
1589 2 std::vector<DeferredLogEntry> logs;
1590 2 std::shared_lock<detail::SrwSharedMutex> mutator_gate(m_mutator_gate);
1591 2 std::shared_lock<detail::SrwSharedMutex> lock(m_hooks_mutex);
1592
1/2
✗ Branch 5 → 6 not taken.
✓ Branch 5 → 18 taken 2 times.
 2 if (m_shutdown_called.load(std::memory_order_acquire))
1593 {
1594 ✗ logs.push_back({"HookManager: Shutdown in progress. Cannot enable all hooks.", LogLevel::Warning});
1595 ✗ return {0, std::move(logs)};
1596 }
1597
1598 2 std::size_t count = 0;
1599
2/2
✓ Branch 30 → 20 taken 2 times.
✓ Branch 30 → 31 taken 2 times.
 4 for (const auto &[hook_id, hook] : m_hooks)
1600 {
1601
2/4
✓ Branch 25 → 26 taken 2 times.
✗ Branch 25 → 48 not taken.
✓ Branch 26 → 27 taken 2 times.
✗ Branch 26 → 28 not taken.
 2 if (toggle_hook_locked(hook_id, *hook, true, logs))
1602 {
1603 2 ++count;
1604 }
1605 }
1606 2 return {count, std::move(logs)};
1607
1/10
✗ Branch 8 → 9 not taken.
✗ Branch 8 → 44 not taken.
✗ Branch 9 → 10 not taken.
✗ Branch 9 → 39 not taken.
✓ Branch 10 → 11 taken 2 times.
✗ Branch 10 → 39 not taken.
✗ Branch 11 → 12 not taken.
✗ Branch 11 → 13 not taken.
✗ Branch 41 → 42 not taken.
✗ Branch 41 → 43 not taken.
 4 }();
1608
1609 // Emit after releasing the gate and hook lock (deferred logging) so a synchronous sink flush or a blocking
1610 // async overflow never stalls an exclusive acquirer inside the critical section.
1611
2/2
✓ Branch 28 → 15 taken 2 times.
✓ Branch 28 → 29 taken 2 times.
 6 for (const auto &entry : deferred_logs)
1612 {
1613
1/2
✓ Branch 18 → 19 taken 2 times.
✗ Branch 18 → 40 not taken.
 2 m_logger.log(entry.level, entry.msg);
1614 }
1615 2 return enabled;
1616
1/4
✗ Branch 29 → 30 not taken.
✓ Branch 29 → 31 taken 2 times.
✗ Branch 41 → 42 not taken.
✗ Branch 41 → 43 not taken.
 4 }
1617
1618 3 std::size_t HookManager::disable_all_hooks()
1619 {
1620
1/2
✗ Branch 3 → 4 not taken.
✓ Branch 3 → 6 taken 3 times.
 3 if (m_shutdown_called.load(std::memory_order_acquire))
1621 {
1622 ✗ m_logger.warning("HookManager: Shutdown in progress. Cannot disable all hooks.");
1623 ✗ return 0;
1624 }
1625 // Fail closed on a reentrant call from inside a with_*/try_with_* callback: it holds m_hooks_mutex shared, so
1626 // re-acquiring this non-recursive lock here is UB / deadlock. Defer the mutation past the callback.
1627
2/2
✓ Branch 7 → 8 taken 1 time.
✓ Branch 7 → 10 taken 2 times.
 3 if (get_reentrancy_guard() > 0)
1628 {
1629
1/2
✓ Branch 8 → 9 taken 1 time.
✗ Branch 8 → 38 not taken.
 1 m_logger.error(
1630 "HookManager: Reentrant disable_all_hooks() from within a with_*/try_with_* callback rejected; "
1631 "defer hook mutation until the callback returns.");
1632 1 return 0;
1633 }
1634
1635 2 auto [disabled, deferred_logs] = [&]() -> std::pair<std::size_t, std::vector<DeferredLogEntry>>
1636 {
1637 2 std::vector<DeferredLogEntry> logs;
1638 2 std::shared_lock<detail::SrwSharedMutex> mutator_gate(m_mutator_gate);
1639 2 std::shared_lock<detail::SrwSharedMutex> lock(m_hooks_mutex);
1640
1/2
✗ Branch 5 → 6 not taken.
✓ Branch 5 → 18 taken 2 times.
 2 if (m_shutdown_called.load(std::memory_order_acquire))
1641 {
1642 ✗ logs.push_back({"HookManager: Shutdown in progress. Cannot disable all hooks.", LogLevel::Warning});
1643 ✗ return {0, std::move(logs)};
1644 }
1645
1646 2 std::size_t count = 0;
1647
2/2
✓ Branch 30 → 20 taken 2 times.
✓ Branch 30 → 31 taken 2 times.
 4 for (const auto &[hook_id, hook] : m_hooks)
1648 {
1649
2/4
✓ Branch 25 → 26 taken 2 times.
✗ Branch 25 → 48 not taken.
✓ Branch 26 → 27 taken 2 times.
✗ Branch 26 → 28 not taken.
 2 if (toggle_hook_locked(hook_id, *hook, false, logs))
1650 {
1651 2 ++count;
1652 }
1653 }
1654 2 return {count, std::move(logs)};
1655
1/10
✗ Branch 8 → 9 not taken.
✗ Branch 8 → 44 not taken.
✗ Branch 9 → 10 not taken.
✗ Branch 9 → 39 not taken.
✓ Branch 10 → 11 taken 2 times.
✗ Branch 10 → 39 not taken.
✗ Branch 11 → 12 not taken.
✗ Branch 11 → 13 not taken.
✗ Branch 41 → 42 not taken.
✗ Branch 41 → 43 not taken.
 4 }();
1656
1657 // Emit after releasing the gate and hook lock (deferred logging) so a synchronous sink flush or a blocking
1658 // async overflow never stalls an exclusive acquirer inside the critical section.
1659
2/2
✓ Branch 28 → 15 taken 2 times.
✓ Branch 28 → 29 taken 2 times.
 6 for (const auto &entry : deferred_logs)
1660 {
1661
1/2
✓ Branch 18 → 19 taken 2 times.
✗ Branch 18 → 40 not taken.
 2 m_logger.log(entry.level, entry.msg);
1662 }
1663 2 return disabled;
1664
1/4
✗ Branch 29 → 30 not taken.
✓ Branch 29 → 31 taken 2 times.
✗ Branch 41 → 42 not taken.
✗ Branch 41 → 43 not taken.
 4 }
1665
1666 29215 std::optional<HookStatus> HookManager::get_hook_status(std::string_view hook_id) const
1667 {
1668
1/2
✓ Branch 2 → 3 taken 29227 times.
✗ Branch 2 → 21 not taken.
 29215 const auto lock = lock_hooks_shared_reentrant();
1669
1/2
✓ Branch 3 → 4 taken 29202 times.
✗ Branch 3 → 19 not taken.
 29227 auto it = m_hooks.find(hook_id);
1670
2/2
✓ Branch 6 → 7 taken 29145 times.
✓ Branch 6 → 13 taken 47 times.
 29202 if (it != m_hooks.end())
1671 {
1672 29145 return it->second->get_status();
1673 }
1674 47 return std::nullopt;
1675 29189 }
1676
1677 51 std::unordered_map<HookStatus, size_t> HookManager::get_hook_counts() const
1678 {
1679
1/2
✓ Branch 2 → 3 taken 51 times.
✗ Branch 2 → 28 not taken.
 51 const auto lock = lock_hooks_shared_reentrant();
1680 51 std::unordered_map<HookStatus, size_t> counts;
1681
1/2
✓ Branch 4 → 5 taken 51 times.
✗ Branch 4 → 20 not taken.
 51 counts[HookStatus::Active] = 0;
1682
1/2
✓ Branch 5 → 6 taken 51 times.
✗ Branch 5 → 21 not taken.
 51 counts[HookStatus::Disabled] = 0;
1683
2/2
✓ Branch 16 → 8 taken 7 times.
✓ Branch 16 → 17 taken 51 times.
 58 for (const auto &[name, hook_ptr] : m_hooks)
1684 {
1685
1/2
✓ Branch 13 → 14 taken 7 times.
✗ Branch 13 → 22 not taken.
 7 counts[hook_ptr->get_status()]++;
1686 }
1687 51 return counts;
1688 51 }
1689
1690 65 std::vector<std::string> HookManager::get_hook_ids(std::optional<HookStatus> status_filter) const
1691 {
1692
1/2
✓ Branch 2 → 3 taken 65 times.
✗ Branch 2 → 31 not taken.
 65 const auto lock = lock_hooks_shared_reentrant();
1693 65 std::vector<std::string> ids;
1694
1/2
✓ Branch 4 → 5 taken 65 times.
✗ Branch 4 → 27 not taken.
 65 ids.reserve(m_hooks.size());
1695
2/2
✓ Branch 22 → 7 taken 12 times.
✓ Branch 22 → 23 taken 65 times.
 77 for (const auto &[name, hook_ptr] : m_hooks)
1696 {
1697
5/8
✓ Branch 11 → 12 taken 6 times.
✓ Branch 11 → 16 taken 6 times.
✓ Branch 14 → 15 taken 6 times.
✗ Branch 14 → 26 not taken.
✓ Branch 15 → 16 taken 6 times.
✗ Branch 15 → 17 not taken.
✓ Branch 18 → 19 taken 12 times.
✗ Branch 18 → 20 not taken.
 12 if (!status_filter.has_value() || hook_ptr->get_status() == status_filter.value())
1698 {
1699
1/2
✓ Branch 19 → 20 taken 12 times.
✗ Branch 19 → 26 not taken.
 12 ids.push_back(name);
1700 }
1701 }
1702 65 return ids;
1703 65 }
1704
1705 40 std::expected<std::string, HookError> HookManager::create_vmt_hook(std::string_view name, void *object)
1706 {
1707
1/2
✓ Branch 2 → 3 taken 40 times.
✗ Branch 2 → 6 not taken.
 80 return create_vmt_hook(name, object, VmtHookConfig{});
1708 }
1709
1710 44 std::expected<std::string, HookError> HookManager::create_vmt_hook(std::string_view name, void *object,
1711 const VmtHookConfig &cfg)
1712 {
1713
1/2
✗ Branch 3 → 4 not taken.
✓ Branch 3 → 8 taken 45 times.
 44 if (m_shutdown_called.load(std::memory_order_acquire))
1714 {
1715 ✗ m_logger.error("HookManager: Shutdown in progress. Cannot create VMT hook '{}'.", name);
1716 ✗ return std::unexpected(HookError::ShutdownInProgress);
1717 }
1718 // Fail closed on a reentrant call from inside a with_*/try_with_* callback: it holds m_hooks_mutex shared, so
1719 // re-acquiring this non-recursive lock here is UB / deadlock. Defer the mutation past the callback.
1720
2/2
✓ Branch 9 → 10 taken 1 time.
✓ Branch 9 → 14 taken 46 times.
 45 if (get_reentrancy_guard() > 0)
1721 {
1722
1/2
✓ Branch 10 → 11 taken 1 time.
✗ Branch 10 → 48 not taken.
 1 m_logger.error("HookManager: Reentrant create_vmt_hook('{}') from within a with_*/try_with_* callback "
1723 "rejected; defer hook mutation until the callback returns.",
1724 name);
1725 1 return std::unexpected(HookError::ReentrantCallRejected);
1726 }
1727
1728 46 auto [result,
1729 46 deferred_logs] = [&]() -> std::pair<std::expected<std::string, HookError>, std::vector<DeferredLogEntry>>
1730 {
1731 46 std::shared_lock<detail::SrwSharedMutex> mutator_gate(m_mutator_gate);
1732
1/2
✓ Branch 3 → 4 taken 46 times.
✗ Branch 3 → 514 not taken.
 46 std::unique_lock<detail::SrwSharedMutex> lock(m_hooks_mutex);
1733
1734
2/2
✓ Branch 5 → 6 taken 7 times.
✓ Branch 5 → 20 taken 39 times.
 46 if (m_shutdown_called.load(std::memory_order_acquire))
1735 {
1736 7 return {std::unexpected(HookError::ShutdownInProgress),
1737 {{std::format("HookManager: Shutdown in progress. Cannot create VMT hook '{}'.", name),
1738
3/6
✓ Branch 10 → 11 taken 7 times.
✗ Branch 10 → 209 not taken.
✓ Branch 15 → 16 taken 7 times.
✓ Branch 15 → 17 taken 7 times.
✗ Branch 213 → 214 not taken.
✗ Branch 213 → 215 not taken.
 21 LogLevel::Error}}};
1739 }
1740
2/2
✓ Branch 20 → 21 taken 2 times.
✓ Branch 20 → 35 taken 37 times.
 39 if (object == nullptr)
1741 {
1742 return {
1743 2 std::unexpected(HookError::InvalidObject),
1744
3/6
✓ Branch 25 → 26 taken 2 times.
✗ Branch 25 → 229 not taken.
✓ Branch 30 → 31 taken 2 times.
✓ Branch 30 → 32 taken 2 times.
✗ Branch 233 → 234 not taken.
✗ Branch 233 → 235 not taken.
 6 {{std::format("HookManager: Object pointer is NULL for VMT hook '{}'.", name), LogLevel::Error}}};
1745 }
1746
3/4
✓ Branch 35 → 36 taken 37 times.
✗ Branch 35 → 512 not taken.
✓ Branch 36 → 37 taken 1 time.
✓ Branch 36 → 51 taken 36 times.
 37 if (vmt_hook_exists_locked(name))
1747 {
1748 1 return {std::unexpected(HookError::HookAlreadyExists),
1749 {{std::format("HookManager: A VMT hook with the name '{}' already exists.", name),
1750
3/6
✓ Branch 41 → 42 taken 1 time.
✗ Branch 41 → 249 not taken.
✓ Branch 46 → 47 taken 1 time.
✓ Branch 46 → 48 taken 1 time.
✗ Branch 253 → 254 not taken.
✗ Branch 253 → 255 not taken.
 3 LogLevel::Error}}};
1751 }
1752
1753 // Pre-flight: read the current vptr and reject if it points at a vtable already cloned by this HookManager.
1754 // SafetyHook::VmtHook::create silently overwrites the vptr with a pointer into a fresh clone, and a second
1755 // call later sees the first clone as the "original" and chains on top of it. The guard makes the failure
1756 // mode visible to the consumer. The reads are SEH-guarded: a garbage vptr is exactly what the opt-in flags
1757 // exist to reject, so an unreadable object or vtable fails closed instead of faulting. When both flags are
1758 // false no read is performed and the legacy path is unchanged.
1759
4/4
✓ Branch 51 → 52 taken 34 times.
✓ Branch 51 → 53 taken 2 times.
✓ Branch 52 → 53 taken 3 times.
✓ Branch 52 → 139 taken 31 times.
 36 if (cfg.fail_if_already_hooked || cfg.fail_on_non_function_pointer)
1760 {
1761 5 const auto current_vptr = Memory::seh_read<std::uintptr_t>(reinterpret_cast<std::uintptr_t>(object));
1762
1/2
✗ Branch 55 → 56 not taken.
✓ Branch 55 → 72 taken 5 times.
 5 if (!current_vptr)
1763 {
1764 ✗ return {std::unexpected(HookError::InvalidObject),
1765 {{std::format("HookManager: VMT hook '{}' refused: object {} vptr is unreadable.", name,
1766 ✗ DetourModKit::Format::format_address(reinterpret_cast<uintptr_t>(object))),
1767 ✗ LogLevel::Error}}};
1768 }
1769
2/2
✓ Branch 72 → 73 taken 2 times.
✓ Branch 72 → 92 taken 3 times.
 5 if (cfg.fail_if_already_hooked)
1770 {
1771
2/2
✓ Branch 75 → 76 taken 1 time.
✓ Branch 75 → 92 taken 1 time.
 2 if (const auto *owner = find_vmt_owner_of_vptr_locked(*current_vptr))
1772 {
1773 1 return {std::unexpected(HookError::HookAlreadyExists),
1774 {{std::format(
1775 "HookManager: VMT hook '{}' refused: object {} is already on the clone owned by "
1776 "'{}'.",
1777 ✗ name, DetourModKit::Format::format_address(reinterpret_cast<uintptr_t>(object)),
1778 *owner),
1779
3/6
✓ Branch 81 → 82 taken 1 time.
✗ Branch 81 → 292 not taken.
✓ Branch 86 → 87 taken 1 time.
✓ Branch 86 → 88 taken 1 time.
✗ Branch 296 → 297 not taken.
✗ Branch 296 → 298 not taken.
 4 LogLevel::Error}}};
1780 }
1781 }
1782
1783 // Pre-flight: refuse to clone when the first slot does not look like a callable function body. A 0xCC
1784 // byte is an int3 alignment pad or permanent breakpoint; an EB/E9 same-module slot is a jump stub and
1785 // cloning it makes the new "original" a forwarder. Tail-calls to outside the module (a `mov reg,reg;
1786 // jmp` to a foreign function) are real functions and pass through.
1787
2/2
✓ Branch 92 → 93 taken 3 times.
✓ Branch 92 → 137 taken 1 time.
 4 if (cfg.fail_on_non_function_pointer)
1788 {
1789 3 const auto slot0 = Memory::seh_read<std::uintptr_t>(*current_vptr);
1790
1/2
✗ Branch 96 → 97 not taken.
✓ Branch 96 → 113 taken 3 times.
 3 if (!slot0)
1791 {
1792 return {
1793 ✗ std::unexpected(HookError::InvalidObject),
1794 {{std::format("HookManager: VMT hook '{}' refused: object {} vtable is unreadable.", name,
1795 ✗ DetourModKit::Format::format_address(reinterpret_cast<uintptr_t>(object))),
1796 ✗ LogLevel::Error}}};
1797 }
1798
2/2
✓ Branch 115 → 116 taken 2 times.
✓ Branch 115 → 135 taken 1 time.
 3 if (!looks_like_function_vmt_slot(*slot0))
1799 {
1800 2 return {std::unexpected(HookError::InvalidObject),
1801 {{std::format("HookManager: VMT hook '{}' refused: object {} first slot {} is not a "
1802 "function pointer.",
1803 name,
1804
1/2
✓ Branch 119 → 120 taken 2 times.
✗ Branch 119 → 351 not taken.
 2 DetourModKit::Format::format_address(reinterpret_cast<uintptr_t>(object)),
1805
1/2
✓ Branch 118 → 119 taken 2 times.
✗ Branch 118 → 354 not taken.
 4 DetourModKit::Format::format_address(*slot0)),
1806
3/6
✓ Branch 123 → 124 taken 2 times.
✗ Branch 123 → 338 not taken.
✓ Branch 128 → 129 taken 2 times.
✓ Branch 128 → 130 taken 2 times.
✗ Branch 342 → 343 not taken.
✗ Branch 342 → 344 not taken.
 8 LogLevel::Error}}};
1807 }
1808 }
1809 }
1810
1811 try
1812 {
1813
1/2
✓ Branch 139 → 140 taken 33 times.
✗ Branch 139 → 434 not taken.
 33 auto vmt_result = safetyhook::VmtHook::create(object);
1814
1815
1/2
✗ Branch 141 → 142 not taken.
✓ Branch 141 → 158 taken 33 times.
 33 if (!vmt_result)
1816 {
1817 return {
1818 ✗ std::unexpected(HookError::SafetyHookError),
1819 {{std::format("HookManager: Failed to create SafetyHook::VmtHook for '{}' on object {}.", name,
1820 ✗ DetourModKit::Format::format_address(reinterpret_cast<uintptr_t>(object))),
1821 ✗ LogLevel::Error}}};
1822 }
1823
1824 // Capture the vptr SafetyHook just installed. After create, *object == &hook.m_new_vmt[1], which is the
1825 // value any future apply_vmt_hook call will see on this object. Recording it lets later
1826 // fail_if_already_hooked checks recognize "object is on this clone" without poking at SafetyHook's
1827 // private layout. The emplace-arg constructor takes the base as a third arg and stores it. The read is
1828 // SEH-guarded for the same reason the pre-flight reads above are: on the default (no-flag) path nothing
1829 // has validated *object on our side, and the page could be reprotected or unmapped between SafetyHook's
1830 // write and this read. A faulting read fails the create closed; returning before the emplace lets
1831 // vmt_result's destructor restore the original vptr, rather than taking down the host on a raw
1832 // dereference.
1833 const auto new_vptr_base_read =
1834 33 Memory::seh_read<std::uintptr_t>(reinterpret_cast<std::uintptr_t>(object));
1835
1/2
✗ Branch 160 → 161 not taken.
✓ Branch 160 → 177 taken 33 times.
 33 if (!new_vptr_base_read)
1836 {
1837 return {
1838 ✗ std::unexpected(HookError::InvalidObject),
1839 {{std::format("HookManager: VMT hook '{}' created on object {} but its installed vptr is "
1840 "unreadable; rolling back.",
1841 ✗ name, DetourModKit::Format::format_address(reinterpret_cast<uintptr_t>(object))),
1842 ✗ LogLevel::Error}}};
1843 }
1844 33 const std::uintptr_t new_vptr_base = *new_vptr_base_read;
1845
1846
1/2
✓ Branch 180 → 181 taken 33 times.
✗ Branch 180 → 412 not taken.
 66 std::string name_str{name};
1847
1848 33 std::vector<DeferredLogEntry> logs;
1849 33 logs.push_back({std::format("HookManager: Successfully created VMT hook '{}' on object {}.", name,
1850 ✗ DetourModKit::Format::format_address(reinterpret_cast<uintptr_t>(object))),
1851 LogLevel::Info});
1852
1853 // Record creation order before emplace: if emplace throws, the stale order entry is a harmless no-op
1854 // erase at teardown, whereas a registered hook missing from the order vector would dodge the ordered
1855 // teardown.
1856
1/2
✓ Branch 189 → 190 taken 33 times.
✗ Branch 189 → 428 not taken.
 33 m_vmt_creation_order.push_back(name_str);
1857
1/2
✓ Branch 195 → 196 taken 33 times.
✗ Branch 195 → 425 not taken.
 33 m_vmt_hooks.emplace(std::piecewise_construct, std::forward_as_tuple(name_str),
1858
1/2
✓ Branch 190 → 191 taken 33 times.
✗ Branch 190 → 426 not taken.
 99 std::forward_as_tuple(name_str, std::move(vmt_result.value()), new_vptr_base));
1859
1860 66 return {std::move(name_str), std::move(logs)};
1861 33 }
1862 ✗ catch (const std::exception &e)
1863 {
1864 ✗ return {std::unexpected(HookError::UnknownError),
1865 ✗ {{std::format("HookManager: Exception during VMT hook creation for '{}': {}", name, e.what()),
1866 ✗ LogLevel::Error}}};
1867 ✗ }
1868 ✗ catch (...)
1869 {
1870 ✗ return {std::unexpected(HookError::UnknownError),
1871 {{std::format("HookManager: Unknown exception during VMT hook creation for '{}'.", name),
1872 ✗ LogLevel::Error}}};
1873 ✗ }
1874
16/134
✓ Branch 7 → 8 taken 7 times.
✗ Branch 7 → 219 not taken.
✓ Branch 14 → 15 taken 46 times.
✗ Branch 14 → 49 not taken.
✗ Branch 17 → 18 not taken.
✓ Branch 17 → 19 taken 7 times.
✓ Branch 22 → 23 taken 2 times.
✗ Branch 22 → 239 not taken.
✗ Branch 32 → 33 not taken.
✓ Branch 32 → 34 taken 2 times.
✓ Branch 38 → 39 taken 1 time.
✗ Branch 38 → 259 not taken.
✗ Branch 48 → 49 not taken.
✓ Branch 48 → 50 taken 1 time.
✗ Branch 57 → 58 not taken.
✗ Branch 57 → 282 not taken.
✗ Branch 58 → 59 not taken.
✗ Branch 58 → 279 not taken.
✗ Branch 68 → 69 not taken.
✗ Branch 68 → 70 not taken.
✓ Branch 77 → 78 taken 1 time.
✗ Branch 77 → 305 not taken.
✓ Branch 78 → 79 taken 1 time.
✗ Branch 78 → 302 not taken.
✗ Branch 88 → 89 not taken.
✓ Branch 88 → 90 taken 1 time.
✗ Branch 98 → 99 not taken.
✗ Branch 98 → 328 not taken.
✗ Branch 99 → 100 not taken.
✗ Branch 99 → 325 not taken.
✗ Branch 109 → 110 not taken.
✗ Branch 109 → 111 not taken.
✓ Branch 120 → 121 taken 2 times.
✗ Branch 120 → 348 not taken.
✗ Branch 130 → 131 not taken.
✓ Branch 130 → 132 taken 2 times.
✗ Branch 143 → 144 not taken.
✗ Branch 143 → 379 not taken.
✗ Branch 144 → 145 not taken.
✗ Branch 144 → 376 not taken.
✗ Branch 154 → 155 not taken.
✗ Branch 154 → 156 not taken.
✗ Branch 162 → 163 not taken.
✗ Branch 162 → 402 not taken.
✗ Branch 163 → 164 not taken.
✗ Branch 163 → 399 not taken.
✗ Branch 173 → 174 not taken.
✗ Branch 173 → 175 not taken.
✓ Branch 182 → 183 taken 33 times.
✗ Branch 182 → 423 not taken.
✓ Branch 183 → 184 taken 33 times.
✗ Branch 183 → 420 not taken.
✓ Branch 184 → 185 taken 33 times.
✗ Branch 184 → 415 not taken.
✗ Branch 186 → 187 not taken.
✓ Branch 186 → 188 taken 33 times.
✗ Branch 216 → 217 not taken.
✗ Branch 216 → 218 not taken.
✗ Branch 220 → 221 not taken.
✗ Branch 220 → 224 not taken.
✗ Branch 222 → 223 not taken.
✗ Branch 222 → 224 not taken.
✗ Branch 236 → 237 not taken.
✗ Branch 236 → 238 not taken.
✗ Branch 240 → 241 not taken.
✗ Branch 240 → 244 not taken.
✗ Branch 242 → 243 not taken.
✗ Branch 242 → 244 not taken.
✗ Branch 256 → 257 not taken.
✗ Branch 256 → 258 not taken.
✗ Branch 260 → 261 not taken.
✗ Branch 260 → 264 not taken.
✗ Branch 262 → 263 not taken.
✗ Branch 262 → 264 not taken.
✗ Branch 276 → 277 not taken.
✗ Branch 276 → 278 not taken.
✗ Branch 283 → 284 not taken.
✗ Branch 283 → 287 not taken.
✗ Branch 285 → 286 not taken.
✗ Branch 285 → 287 not taken.
✗ Branch 299 → 300 not taken.
✗ Branch 299 → 301 not taken.
✗ Branch 306 → 307 not taken.
✗ Branch 306 → 310 not taken.
✗ Branch 308 → 309 not taken.
✗ Branch 308 → 310 not taken.
✗ Branch 322 → 323 not taken.
✗ Branch 322 → 324 not taken.
✗ Branch 329 → 330 not taken.
✗ Branch 329 → 333 not taken.
✗ Branch 331 → 332 not taken.
✗ Branch 331 → 333 not taken.
✗ Branch 345 → 346 not taken.
✗ Branch 345 → 347 not taken.
✗ Branch 355 → 356 not taken.
✗ Branch 355 → 359 not taken.
✗ Branch 357 → 358 not taken.
✗ Branch 357 → 359 not taken.
✗ Branch 373 → 374 not taken.
✗ Branch 373 → 375 not taken.
✗ Branch 380 → 381 not taken.
✗ Branch 380 → 384 not taken.
✗ Branch 382 → 383 not taken.
✗ Branch 382 → 384 not taken.
✗ Branch 396 → 397 not taken.
✗ Branch 396 → 398 not taken.
✗ Branch 403 → 404 not taken.
✗ Branch 403 → 407 not taken.
✗ Branch 405 → 406 not taken.
✗ Branch 405 → 407 not taken.
✗ Branch 417 → 418 not taken.
✗ Branch 417 → 419 not taken.
✗ Branch 439 → 440 not taken.
✗ Branch 439 → 477 not taken.
✗ Branch 449 → 450 not taken.
✗ Branch 449 → 451 not taken.
✗ Branch 454 → 455 not taken.
✗ Branch 454 → 500 not taken.
✗ Branch 464 → 465 not taken.
✗ Branch 464 → 466 not taken.
✗ Branch 466 → 205 not taken.
✗ Branch 466 → 512 not taken.
✗ Branch 474 → 475 not taken.
✗ Branch 474 → 476 not taken.
✗ Branch 479 → 480 not taken.
✗ Branch 479 → 483 not taken.
✗ Branch 481 → 482 not taken.
✗ Branch 481 → 483 not taken.
✗ Branch 497 → 498 not taken.
✗ Branch 497 → 499 not taken.
✗ Branch 501 → 502 not taken.
✗ Branch 501 → 505 not taken.
✗ Branch 503 → 504 not taken.
✗ Branch 503 → 505 not taken.
 176 }();
1875
1876
2/2
✓ Branch 32 → 19 taken 46 times.
✓ Branch 32 → 33 taken 46 times.
 138 for (const auto &entry : deferred_logs)
1877 {
1878
1/2
✓ Branch 22 → 23 taken 46 times.
✗ Branch 22 → 50 not taken.
 46 m_logger.log(entry.level, entry.msg);
1879 }
1880
2/2
✓ Branch 34 → 35 taken 33 times.
✓ Branch 34 → 38 taken 13 times.
 46 if (result)
1881 {
1882 33 emit_hook_lifecycle(*result, Diagnostics::HookKind::Vmt, Diagnostics::HookTransition::Created);
1883 }
1884 46 return result;
1885
1/4
✗ Branch 39 → 40 not taken.
✓ Branch 39 → 41 taken 46 times.
✗ Branch 51 → 52 not taken.
✗ Branch 51 → 53 not taken.
 92 }
1886
1887 6 std::expected<void, HookError> HookManager::remove_vmt_hook(std::string_view vmt_name)
1888 {
1889
1/2
✗ Branch 3 → 4 not taken.
✓ Branch 3 → 9 taken 6 times.
 6 if (m_shutdown_called.load(std::memory_order_acquire))
1890 {
1891 ✗ m_logger.warning("HookManager: Shutdown in progress. Cannot remove VMT hook '{}'.", vmt_name);
1892 ✗ return std::unexpected(HookError::ShutdownInProgress);
1893 }
1894 // Fail closed on a reentrant call from inside a with_*/try_with_* callback: it holds m_hooks_mutex shared, so
1895 // re-acquiring this non-recursive lock here is UB / deadlock. Defer the mutation past the callback.
1896
2/2
✓ Branch 10 → 11 taken 1 time.
✓ Branch 10 → 16 taken 5 times.
 6 if (get_reentrancy_guard() > 0)
1897 {
1898
1/2
✓ Branch 11 → 12 taken 1 time.
✗ Branch 11 → 49 not taken.
 1 m_logger.warning("HookManager: Reentrant remove_vmt_hook('{}') from within a with_*/try_with_* callback "
1899 "rejected; defer hook mutation until the callback returns.",
1900 vmt_name);
1901 1 return std::unexpected(HookError::ReentrantCallRejected);
1902 }
1903
1904 5 std::string lifecycle_name;
1905 5 auto [result, deferred_logs] = [&]() -> std::pair<std::expected<void, HookError>, std::vector<DeferredLogEntry>>
1906 {
1907 5 std::shared_lock<detail::SrwSharedMutex> mutator_gate(m_mutator_gate);
1908
1/2
✓ Branch 3 → 4 taken 5 times.
✗ Branch 3 → 127 not taken.
 5 std::unique_lock<detail::SrwSharedMutex> lock(m_hooks_mutex);
1909 // Re-check after acquiring the gate so a teardown that flipped m_shutdown_called while we waited is not
1910 // raced (uniform with the create/enable/disable mutators).
1911
1/2
✗ Branch 5 → 6 not taken.
✓ Branch 5 → 20 taken 5 times.
 5 if (m_shutdown_called.load(std::memory_order_acquire))
1912 {
1913 ✗ return {std::unexpected(HookError::ShutdownInProgress),
1914 {{std::format("HookManager: Shutdown in progress. Cannot remove VMT hook '{}'.", vmt_name),
1915 ✗ LogLevel::Warning}}};
1916 }
1917
1/2
✓ Branch 20 → 21 taken 5 times.
✗ Branch 20 → 125 not taken.
 5 auto it = m_vmt_hooks.find(vmt_name);
1918
2/2
✓ Branch 23 → 24 taken 4 times.
✓ Branch 23 → 45 taken 1 time.
 5 if (it != m_vmt_hooks.end())
1919 {
1920
1/2
✓ Branch 26 → 27 taken 4 times.
✗ Branch 26 → 104 not taken.
 4 std::string removed_name = it->second.get_name();
1921
1/2
✓ Branch 27 → 28 taken 4 times.
✗ Branch 27 → 102 not taken.
 4 lifecycle_name = removed_name;
1922
1/2
✓ Branch 28 → 29 taken 4 times.
✗ Branch 28 → 102 not taken.
 4 m_vmt_hooks.erase(it);
1923
1/2
✓ Branch 29 → 30 taken 4 times.
✗ Branch 29 → 102 not taken.
 4 std::erase(m_vmt_creation_order, removed_name);
1924 4 return {std::expected<void, HookError>{},
1925
3/6
✓ Branch 34 → 35 taken 4 times.
✗ Branch 34 → 83 not taken.
✓ Branch 39 → 40 taken 4 times.
✓ Branch 39 → 41 taken 4 times.
✗ Branch 87 → 88 not taken.
✗ Branch 87 → 89 not taken.
 12 {{std::format("HookManager: VMT hook '{}' has been removed.", removed_name), LogLevel::Debug}}};
1926 ✗ }
1927 1 return {std::unexpected(HookError::VmtHookNotFound),
1928 {{std::format("HookManager: Attempted to remove VMT hook '{}', but it was not found.", vmt_name),
1929
3/6
✓ Branch 49 → 50 taken 1 time.
✗ Branch 49 → 105 not taken.
✓ Branch 54 → 55 taken 1 time.
✓ Branch 54 → 56 taken 1 time.
✗ Branch 109 → 110 not taken.
✗ Branch 109 → 111 not taken.
 3 LogLevel::Warning}}};
1930
5/31
✗ Branch 7 → 8 not taken.
✗ Branch 7 → 73 not taken.
✓ Branch 17 → 18 taken 5 times.
✗ Branch 17 → 19 not taken.
✗ Branch 17 → 50 not taken.
✓ Branch 31 → 32 taken 4 times.
✗ Branch 31 → 93 not taken.
✗ Branch 41 → 42 not taken.
✓ Branch 41 → 43 taken 4 times.
✓ Branch 46 → 47 taken 1 time.
✗ Branch 46 → 115 not taken.
✗ Branch 56 → 57 not taken.
✓ Branch 56 → 58 taken 1 time.
✗ Branch 70 → 71 not taken.
✗ Branch 70 → 72 not taken.
✗ Branch 74 → 75 not taken.
✗ Branch 74 → 78 not taken.
✗ Branch 76 → 77 not taken.
✗ Branch 76 → 78 not taken.
✗ Branch 90 → 91 not taken.
✗ Branch 90 → 92 not taken.
✗ Branch 94 → 95 not taken.
✗ Branch 94 → 98 not taken.
✗ Branch 96 → 97 not taken.
✗ Branch 96 → 98 not taken.
✗ Branch 112 → 113 not taken.
✗ Branch 112 → 114 not taken.
✗ Branch 116 → 117 not taken.
✗ Branch 116 → 120 not taken.
✗ Branch 118 → 119 not taken.
✗ Branch 118 → 120 not taken.
 19 }();
1931
1932
2/2
✓ Branch 35 → 22 taken 5 times.
✓ Branch 35 → 36 taken 5 times.
 15 for (const auto &entry : deferred_logs)
1933 {
1934
1/2
✓ Branch 25 → 26 taken 5 times.
✗ Branch 25 → 51 not taken.
 5 m_logger.log(entry.level, entry.msg);
1935 }
1936
2/2
✓ Branch 37 → 38 taken 4 times.
✓ Branch 37 → 40 taken 1 time.
 5 if (result)
1937 {
1938 4 emit_hook_lifecycle(lifecycle_name, Diagnostics::HookKind::Vmt, Diagnostics::HookTransition::Removed);
1939 }
1940 5 return result;
1941
1/4
✗ Branch 40 → 41 not taken.
✓ Branch 40 → 42 taken 5 times.
✗ Branch 52 → 53 not taken.
✗ Branch 52 → 54 not taken.
 15 }
1942
1943 3 std::expected<void, HookError> HookManager::remove_vmt_method(std::string_view vmt_name, size_t method_index)
1944 {
1945
1/2
✗ Branch 3 → 4 not taken.
✓ Branch 3 → 9 taken 3 times.
 3 if (m_shutdown_called.load(std::memory_order_acquire))
1946 {
1947 ✗ m_logger.warning("HookManager: Shutdown in progress. Cannot remove VMT method on '{}'.", vmt_name);
1948 ✗ return std::unexpected(HookError::ShutdownInProgress);
1949 }
1950 // Fail closed on a reentrant call from inside a with_*/try_with_* callback: it holds m_hooks_mutex shared, so
1951 // re-acquiring this non-recursive lock here is UB / deadlock. Defer the mutation past the callback.
1952
2/2
✓ Branch 10 → 11 taken 1 time.
✓ Branch 10 → 16 taken 2 times.
 3 if (get_reentrancy_guard() > 0)
1953 {
1954
1/2
✓ Branch 11 → 12 taken 1 time.
✗ Branch 11 → 44 not taken.
 1 m_logger.warning("HookManager: Reentrant remove_vmt_method('{}') from within a with_*/try_with_* callback "
1955 "rejected; defer hook mutation until the callback returns.",
1956 vmt_name);
1957 1 return std::unexpected(HookError::ReentrantCallRejected);
1958 }
1959
1960 2 auto [result, deferred_logs] = [&]() -> std::pair<std::expected<void, HookError>, std::vector<DeferredLogEntry>>
1961 {
1962 2 std::shared_lock<detail::SrwSharedMutex> mutator_gate(m_mutator_gate);
1963
1/2
✓ Branch 3 → 4 taken 2 times.
✗ Branch 3 → 154 not taken.
 2 std::unique_lock<detail::SrwSharedMutex> lock(m_hooks_mutex);
1964
1/2
✗ Branch 5 → 6 not taken.
✓ Branch 5 → 20 taken 2 times.
 2 if (m_shutdown_called.load(std::memory_order_acquire))
1965 {
1966 ✗ return {std::unexpected(HookError::ShutdownInProgress),
1967 {{std::format("HookManager: Shutdown in progress. Cannot remove VMT method on '{}'.", vmt_name),
1968 ✗ LogLevel::Warning}}};
1969 }
1970
1/2
✓ Branch 20 → 21 taken 2 times.
✗ Branch 20 → 152 not taken.
 2 auto it = m_vmt_hooks.find(vmt_name);
1971
1/2
✗ Branch 23 → 24 not taken.
✓ Branch 23 → 38 taken 2 times.
 2 if (it == m_vmt_hooks.end())
1972 {
1973 ✗ return {std::unexpected(HookError::VmtHookNotFound),
1974 {{std::format("HookManager: VMT hook '{}' not found for method removal.", vmt_name),
1975 ✗ LogLevel::Warning}}};
1976 }
1977
1978
3/4
✓ Branch 39 → 40 taken 2 times.
✗ Branch 39 → 152 not taken.
✓ Branch 40 → 41 taken 1 time.
✓ Branch 40 → 55 taken 1 time.
 2 if (it->second.remove_method_hook(method_index))
1979 {
1980 return {
1981 1 std::expected<void, HookError>{},
1982 {{std::format("HookManager: VMT '{}' method index {} has been unhooked.", vmt_name, method_index),
1983
3/6
✓ Branch 45 → 46 taken 1 time.
✗ Branch 45 → 113 not taken.
✓ Branch 50 → 51 taken 1 time.
✓ Branch 50 → 52 taken 1 time.
✗ Branch 117 → 118 not taken.
✗ Branch 117 → 119 not taken.
 3 LogLevel::Debug}}};
1984 }
1985 1 return {std::unexpected(HookError::MethodNotFound),
1986 {{std::format("HookManager: VMT '{}' has no hooked method at index {}.", vmt_name, method_index),
1987
3/6
✓ Branch 59 → 60 taken 1 time.
✗ Branch 59 → 132 not taken.
✓ Branch 64 → 65 taken 1 time.
✓ Branch 64 → 66 taken 1 time.
✗ Branch 136 → 137 not taken.
✗ Branch 136 → 138 not taken.
 3 LogLevel::Warning}}};
1988
5/42
✗ Branch 7 → 8 not taken.
✗ Branch 7 → 83 not taken.
✓ Branch 16 → 17 taken 2 times.
✗ Branch 16 → 45 not taken.
✗ Branch 17 → 18 not taken.
✗ Branch 17 → 19 not taken.
✗ Branch 25 → 26 not taken.
✗ Branch 25 → 103 not taken.
✗ Branch 35 → 36 not taken.
✗ Branch 35 → 37 not taken.
✓ Branch 42 → 43 taken 1 time.
✗ Branch 42 → 123 not taken.
✗ Branch 52 → 53 not taken.
✓ Branch 52 → 54 taken 1 time.
✓ Branch 56 → 57 taken 1 time.
✗ Branch 56 → 142 not taken.
✗ Branch 66 → 67 not taken.
✓ Branch 66 → 68 taken 1 time.
✗ Branch 80 → 81 not taken.
✗ Branch 80 → 82 not taken.
✗ Branch 84 → 85 not taken.
✗ Branch 84 → 88 not taken.
✗ Branch 86 → 87 not taken.
✗ Branch 86 → 88 not taken.
✗ Branch 100 → 101 not taken.
✗ Branch 100 → 102 not taken.
✗ Branch 104 → 105 not taken.
✗ Branch 104 → 108 not taken.
✗ Branch 106 → 107 not taken.
✗ Branch 106 → 108 not taken.
✗ Branch 120 → 121 not taken.
✗ Branch 120 → 122 not taken.
✗ Branch 124 → 125 not taken.
✗ Branch 124 → 128 not taken.
✗ Branch 126 → 127 not taken.
✗ Branch 126 → 128 not taken.
✗ Branch 139 → 140 not taken.
✗ Branch 139 → 141 not taken.
✗ Branch 143 → 144 not taken.
✗ Branch 143 → 147 not taken.
✗ Branch 145 → 146 not taken.
✗ Branch 145 → 147 not taken.
 6 }();
1989
1990
2/2
✓ Branch 34 → 21 taken 2 times.
✓ Branch 34 → 35 taken 2 times.
 6 for (const auto &entry : deferred_logs)
1991 {
1992
1/2
✓ Branch 24 → 25 taken 2 times.
✗ Branch 24 → 46 not taken.
 2 m_logger.log(entry.level, entry.msg);
1993 }
1994 2 return result;
1995
1/4
✗ Branch 35 → 36 not taken.
✓ Branch 35 → 37 taken 2 times.
✗ Branch 47 → 48 not taken.
✗ Branch 47 → 49 not taken.
 4 }
1996
1997 4 bool HookManager::apply_vmt_hook(std::string_view vmt_name, void *object)
1998 {
1999
1/2
✓ Branch 2 → 3 taken 4 times.
✗ Branch 2 → 6 not taken.
 4 return apply_vmt_hook(vmt_name, object, VmtHookConfig{});
2000 }
2001
2002 8 bool HookManager::apply_vmt_hook(std::string_view vmt_name, void *object, const VmtHookConfig &cfg)
2003 {
2004
1/2
✗ Branch 3 → 4 not taken.
✓ Branch 3 → 6 taken 8 times.
 8 if (m_shutdown_called.load(std::memory_order_acquire))
2005 {
2006 ✗ m_logger.warning("HookManager: Shutdown in progress. Cannot apply VMT hook '{}'.", vmt_name);
2007 ✗ return false;
2008 }
2009
2/2
✓ Branch 6 → 7 taken 1 time.
✓ Branch 6 → 9 taken 7 times.
 8 if (object == nullptr)
2010 {
2011
1/2
✓ Branch 7 → 8 taken 1 time.
✗ Branch 7 → 41 not taken.
 1 m_logger.warning("HookManager: Cannot apply VMT hook '{}' to null object.", vmt_name);
2012 1 return false;
2013 }
2014 // Fail closed on a reentrant call from inside a with_*/try_with_* callback: it holds m_hooks_mutex shared, so
2015 // re-acquiring this non-recursive lock here is UB / deadlock. Defer the mutation past the callback.
2016
2/2
✓ Branch 10 → 11 taken 1 time.
✓ Branch 10 → 13 taken 6 times.
 7 if (get_reentrancy_guard() > 0)
2017 {
2018
1/2
✓ Branch 11 → 12 taken 1 time.
✗ Branch 11 → 42 not taken.
 1 m_logger.warning("HookManager: Reentrant apply_vmt_hook('{}') from within a with_*/try_with_* callback "
2019 "rejected; defer hook mutation until the callback returns.",
2020 vmt_name);
2021 1 return false;
2022 }
2023
2024 6 auto [result, deferred_logs] = [&]() -> std::pair<bool, std::vector<DeferredLogEntry>>
2025 {
2026 6 std::shared_lock<detail::SrwSharedMutex> mutator_gate(m_mutator_gate);
2027
1/2
✓ Branch 3 → 4 taken 6 times.
✗ Branch 3 → 420 not taken.
 6 std::unique_lock<detail::SrwSharedMutex> lock(m_hooks_mutex);
2028
1/2
✗ Branch 5 → 6 not taken.
✓ Branch 5 → 19 taken 6 times.
 6 if (m_shutdown_called.load(std::memory_order_acquire))
2029 {
2030 return {false,
2031 {{std::format("HookManager: Shutdown in progress. Cannot apply VMT hook '{}'.", vmt_name),
2032 ✗ LogLevel::Warning}}};
2033 }
2034
1/2
✓ Branch 19 → 20 taken 6 times.
✗ Branch 19 → 418 not taken.
 6 auto it = m_vmt_hooks.find(vmt_name);
2035
2/2
✓ Branch 22 → 23 taken 1 time.
✓ Branch 22 → 36 taken 5 times.
 6 if (it == m_vmt_hooks.end())
2036 {
2037 return {
2038 false,
2039
3/6
✓ Branch 26 → 27 taken 1 time.
✗ Branch 26 → 179 not taken.
✓ Branch 31 → 32 taken 1 time.
✓ Branch 31 → 33 taken 1 time.
✗ Branch 183 → 184 not taken.
✗ Branch 183 → 185 not taken.
 3 {{std::format("HookManager: VMT hook '{}' not found for apply.", vmt_name), LogLevel::Warning}}};
2040 }
2041
2042 // The pre-flight reads are SEH-guarded: a garbage vptr is exactly what the opt-in flags exist to reject, so
2043 // an unreadable object or vtable fails closed instead of faulting. When both flags are false no read is
2044 // performed and the legacy path is unchanged.
2045
4/4
✓ Branch 36 → 37 taken 2 times.
✓ Branch 36 → 38 taken 3 times.
✓ Branch 37 → 38 taken 1 time.
✓ Branch 37 → 138 taken 1 time.
 5 if (cfg.fail_if_already_hooked || cfg.fail_on_non_function_pointer)
2046 {
2047 4 const auto current_vptr = Memory::seh_read<std::uintptr_t>(reinterpret_cast<std::uintptr_t>(object));
2048
1/2
✗ Branch 40 → 41 not taken.
✓ Branch 40 → 56 taken 4 times.
 4 if (!current_vptr)
2049 {
2050 return {false,
2051 {{std::format("HookManager: VMT hook '{}' apply refused: object {} vptr is unreadable.",
2052 vmt_name,
2053 ✗ DetourModKit::Format::format_address(reinterpret_cast<uintptr_t>(object))),
2054 ✗ LogLevel::Error}}};
2055 }
2056
2057 // Re-apply guard. SafetyHook::VmtHook::apply does m_objects.emplace(object, ...) which is silently
2058 // idempotent for a key that already exists; the guard makes the "already on this clone" case observable
2059 // for callers that want apply to be a clean no-op rather than a silent no-op. The lookup is
2060 // registry-wide: an object already on a clone owned by a *different* hook of this manager must be
2061 // refused, not layered onto. Mirrors create_vmt_hook's fail_if_already_hooked semantics.
2062
2/2
✓ Branch 56 → 57 taken 3 times.
✓ Branch 56 → 93 taken 1 time.
 4 if (cfg.fail_if_already_hooked)
2063 {
2064
2/2
✓ Branch 59 → 60 taken 2 times.
✓ Branch 59 → 93 taken 1 time.
 3 if (const auto *owner = find_vmt_owner_of_vptr_locked(*current_vptr))
2065 {
2066
2/2
✓ Branch 62 → 63 taken 1 time.
✓ Branch 62 → 78 taken 1 time.
 2 if (*owner == vmt_name)
2067 {
2068 return {true,
2069 {{std::format(
2070 "HookManager: VMT hook '{}' already applied to object {}; no-op.", vmt_name,
2071 ✗ DetourModKit::Format::format_address(reinterpret_cast<uintptr_t>(object))),
2072
3/6
✓ Branch 67 → 68 taken 1 time.
✗ Branch 67 → 220 not taken.
✓ Branch 72 → 73 taken 1 time.
✓ Branch 72 → 74 taken 1 time.
✗ Branch 224 → 225 not taken.
✗ Branch 224 → 226 not taken.
 4 LogLevel::Debug}}};
2073 }
2074 return {false,
2075 {{std::format("HookManager: VMT hook '{}' apply refused: object {} is already on the "
2076 "clone owned by '{}'.",
2077 vmt_name,
2078 ✗ DetourModKit::Format::format_address(reinterpret_cast<uintptr_t>(object)),
2079 *owner),
2080
3/6
✓ Branch 82 → 83 taken 1 time.
✗ Branch 82 → 242 not taken.
✓ Branch 87 → 88 taken 1 time.
✓ Branch 87 → 89 taken 1 time.
✗ Branch 246 → 247 not taken.
✗ Branch 246 → 248 not taken.
 4 LogLevel::Error}}};
2081 }
2082 }
2083
2084 // Re-run the pre-flight decoder against the vtable currently installed on the object (the one about to
2085 // be replaced). apply does not change the *target* vtable shape (only the vptr swap), so the decode is
2086 // identical to the create path: reject int3 padding, bare RETs, and same-module jump stubs at the
2087 // destination.
2088
2/2
✓ Branch 93 → 94 taken 1 time.
✓ Branch 93 → 136 taken 1 time.
 2 if (cfg.fail_on_non_function_pointer)
2089 {
2090 1 const auto slot0 = Memory::seh_read<std::uintptr_t>(*current_vptr);
2091
1/2
✗ Branch 97 → 98 not taken.
✓ Branch 97 → 113 taken 1 time.
 1 if (!slot0)
2092 {
2093 return {
2094 false,
2095 {{std::format("HookManager: VMT hook '{}' apply refused: object {} vtable is unreadable.",
2096 vmt_name,
2097 ✗ DetourModKit::Format::format_address(reinterpret_cast<uintptr_t>(object))),
2098 ✗ LogLevel::Error}}};
2099 }
2100
1/2
✓ Branch 115 → 116 taken 1 time.
✗ Branch 115 → 134 not taken.
 1 if (!looks_like_function_vmt_slot(*slot0))
2101 {
2102 return {
2103 false,
2104 {{std::format("HookManager: VMT hook '{}' apply refused: object {} first slot {} is not "
2105 "a function pointer.",
2106 vmt_name,
2107
1/2
✓ Branch 118 → 119 taken 1 time.
✗ Branch 118 → 299 not taken.
 1 DetourModKit::Format::format_address(reinterpret_cast<uintptr_t>(object)),
2108
1/2
✓ Branch 117 → 118 taken 1 time.
✗ Branch 117 → 302 not taken.
 2 DetourModKit::Format::format_address(*slot0)),
2109
3/6
✓ Branch 122 → 123 taken 1 time.
✗ Branch 122 → 286 not taken.
✓ Branch 127 → 128 taken 1 time.
✓ Branch 127 → 129 taken 1 time.
✗ Branch 290 → 291 not taken.
✗ Branch 290 → 292 not taken.
 4 LogLevel::Error}}};
2110 }
2111 }
2112 }
2113
2114 // VmtHook::apply tracks the object in an internal container, so it can throw bad_alloc. Contain it here as
2115 // every other SafetyHook call site does, so a failed apply returns false instead of unwinding out through
2116 // the held locks.
2117 try
2118 {
2119
1/2
✓ Branch 140 → 141 taken 2 times.
✗ Branch 140 → 313 not taken.
 2 it->second.vmt_hook().apply(object);
2120 }
2121 ✗ catch (const std::exception &e)
2122 {
2123 return {
2124 false,
2125 {{std::format("HookManager: Exception applying VMT hook '{}' to object {}: {}", vmt_name,
2126 ✗ DetourModKit::Format::format_address(reinterpret_cast<uintptr_t>(object)), e.what()),
2127 ✗ LogLevel::Error}}};
2128 ✗ }
2129 ✗ catch (...)
2130 {
2131 return {false,
2132 {{std::format("HookManager: Unknown exception applying VMT hook '{}' to object {}.", vmt_name,
2133 ✗ DetourModKit::Format::format_address(reinterpret_cast<uintptr_t>(object))),
2134 ✗ LogLevel::Error}}};
2135 ✗ }
2136 return {true,
2137 {{std::format("HookManager: VMT hook '{}' applied to object {}.", vmt_name,
2138 ✗ DetourModKit::Format::format_address(reinterpret_cast<uintptr_t>(object))),
2139
3/6
✓ Branch 145 → 146 taken 2 times.
✗ Branch 145 → 396 not taken.
✓ Branch 150 → 151 taken 2 times.
✓ Branch 150 → 152 taken 2 times.
✗ Branch 400 → 401 not taken.
✗ Branch 400 → 402 not taken.
 8 LogLevel::Debug}}};
2140
14/114
✗ Branch 6 → 7 not taken.
✗ Branch 6 → 170 not taken.
✓ Branch 13 → 14 taken 6 times.
✗ Branch 13 → 43 not taken.
✗ Branch 16 → 17 not taken.
✗ Branch 16 → 18 not taken.
✓ Branch 23 → 24 taken 1 time.
✗ Branch 23 → 189 not taken.
✗ Branch 33 → 34 not taken.
✓ Branch 33 → 35 taken 1 time.
✗ Branch 41 → 42 not taken.
✗ Branch 41 → 211 not taken.
✗ Branch 42 → 43 not taken.
✗ Branch 42 → 208 not taken.
✗ Branch 52 → 53 not taken.
✗ Branch 52 → 54 not taken.
✓ Branch 63 → 64 taken 1 time.
✗ Branch 63 → 233 not taken.
✓ Branch 64 → 65 taken 1 time.
✗ Branch 64 → 230 not taken.
✗ Branch 74 → 75 not taken.
✓ Branch 74 → 76 taken 1 time.
✓ Branch 78 → 79 taken 1 time.
✗ Branch 78 → 255 not taken.
✓ Branch 79 → 80 taken 1 time.
✗ Branch 79 → 252 not taken.
✗ Branch 89 → 90 not taken.
✓ Branch 89 → 91 taken 1 time.
✗ Branch 98 → 99 not taken.
✗ Branch 98 → 277 not taken.
✗ Branch 99 → 100 not taken.
✗ Branch 99 → 274 not taken.
✗ Branch 109 → 110 not taken.
✗ Branch 109 → 111 not taken.
✓ Branch 119 → 120 taken 1 time.
✗ Branch 119 → 296 not taken.
✗ Branch 129 → 130 not taken.
✓ Branch 129 → 131 taken 1 time.
✓ Branch 141 → 142 taken 2 times.
✗ Branch 141 → 409 not taken.
✓ Branch 142 → 143 taken 2 times.
✗ Branch 142 → 406 not taken.
✗ Branch 152 → 153 not taken.
✓ Branch 152 → 154 taken 2 times.
✗ Branch 167 → 168 not taken.
✗ Branch 167 → 169 not taken.
✗ Branch 171 → 172 not taken.
✗ Branch 171 → 175 not taken.
✗ Branch 173 → 174 not taken.
✗ Branch 173 → 175 not taken.
✗ Branch 186 → 187 not taken.
✗ Branch 186 → 188 not taken.
✗ Branch 190 → 191 not taken.
✗ Branch 190 → 194 not taken.
✗ Branch 192 → 193 not taken.
✗ Branch 192 → 194 not taken.
✗ Branch 205 → 206 not taken.
✗ Branch 205 → 207 not taken.
✗ Branch 212 → 213 not taken.
✗ Branch 212 → 216 not taken.
✗ Branch 214 → 215 not taken.
✗ Branch 214 → 216 not taken.
✗ Branch 227 → 228 not taken.
✗ Branch 227 → 229 not taken.
✗ Branch 234 → 235 not taken.
✗ Branch 234 → 238 not taken.
✗ Branch 236 → 237 not taken.
✗ Branch 236 → 238 not taken.
✗ Branch 249 → 250 not taken.
✗ Branch 249 → 251 not taken.
✗ Branch 256 → 257 not taken.
✗ Branch 256 → 260 not taken.
✗ Branch 258 → 259 not taken.
✗ Branch 258 → 260 not taken.
✗ Branch 271 → 272 not taken.
✗ Branch 271 → 273 not taken.
✗ Branch 278 → 279 not taken.
✗ Branch 278 → 282 not taken.
✗ Branch 280 → 281 not taken.
✗ Branch 280 → 282 not taken.
✗ Branch 293 → 294 not taken.
✗ Branch 293 → 295 not taken.
✗ Branch 303 → 304 not taken.
✗ Branch 303 → 307 not taken.
✗ Branch 305 → 306 not taken.
✗ Branch 305 → 307 not taken.
✗ Branch 317 → 318 not taken.
✗ Branch 317 → 357 not taken.
✗ Branch 327 → 328 not taken.
✗ Branch 327 → 329 not taken.
✗ Branch 332 → 333 not taken.
✗ Branch 332 → 385 not taken.
✗ Branch 333 → 334 not taken.
✗ Branch 333 → 382 not taken.
✗ Branch 343 → 344 not taken.
✗ Branch 343 → 345 not taken.
✗ Branch 354 → 355 not taken.
✗ Branch 354 → 356 not taken.
✗ Branch 362 → 363 not taken.
✗ Branch 362 → 366 not taken.
✗ Branch 364 → 365 not taken.
✗ Branch 364 → 366 not taken.
✗ Branch 379 → 380 not taken.
✗ Branch 379 → 381 not taken.
✗ Branch 386 → 387 not taken.
✗ Branch 386 → 390 not taken.
✗ Branch 388 → 389 not taken.
✗ Branch 388 → 390 not taken.
✗ Branch 403 → 404 not taken.
✗ Branch 403 → 405 not taken.
✗ Branch 410 → 411 not taken.
✗ Branch 410 → 414 not taken.
✗ Branch 412 → 413 not taken.
✗ Branch 412 → 414 not taken.
 24 }();
2141
2142
2/2
✓ Branch 31 → 18 taken 6 times.
✓ Branch 31 → 32 taken 6 times.
 18 for (const auto &entry : deferred_logs)
2143 {
2144
1/2
✓ Branch 21 → 22 taken 6 times.
✗ Branch 21 → 44 not taken.
 6 m_logger.log(entry.level, entry.msg);
2145 }
2146 6 return result;
2147
1/4
✗ Branch 32 → 33 not taken.
✓ Branch 32 → 34 taken 6 times.
✗ Branch 45 → 46 not taken.
✗ Branch 45 → 47 not taken.
 12 }
2148
2149 4 bool HookManager::remove_vmt_from_object(std::string_view vmt_name, void *object)
2150 {
2151
1/2
✗ Branch 3 → 4 not taken.
✓ Branch 3 → 6 taken 4 times.
 4 if (m_shutdown_called.load(std::memory_order_acquire))
2152 {
2153 ✗ m_logger.warning("HookManager: Shutdown in progress. Cannot remove VMT hook '{}' from object.", vmt_name);
2154 ✗ return false;
2155 }
2156
2/2
✓ Branch 6 → 7 taken 1 time.
✓ Branch 6 → 9 taken 3 times.
 4 if (object == nullptr)
2157 {
2158
1/2
✓ Branch 7 → 8 taken 1 time.
✗ Branch 7 → 41 not taken.
 1 m_logger.warning("HookManager: Cannot remove VMT hook '{}' from null object.", vmt_name);
2159 1 return false;
2160 }
2161 // Fail closed on a reentrant call from inside a with_*/try_with_* callback: it holds m_hooks_mutex shared, so
2162 // re-acquiring this non-recursive lock here is UB / deadlock. Defer the mutation past the callback.
2163
2/2
✓ Branch 10 → 11 taken 1 time.
✓ Branch 10 → 13 taken 2 times.
 3 if (get_reentrancy_guard() > 0)
2164 {
2165
1/2
✓ Branch 11 → 12 taken 1 time.
✗ Branch 11 → 42 not taken.
 1 m_logger.warning(
2166 "HookManager: Reentrant remove_vmt_from_object('{}') from within a with_*/try_with_* callback "
2167 "rejected; defer hook mutation until the callback returns.",
2168 vmt_name);
2169 1 return false;
2170 }
2171
2172 2 auto [result, deferred_logs] = [&]() -> std::pair<bool, std::vector<DeferredLogEntry>>
2173 {
2174 2 std::shared_lock<detail::SrwSharedMutex> mutator_gate(m_mutator_gate);
2175
1/2
✓ Branch 3 → 4 taken 2 times.
✗ Branch 3 → 120 not taken.
 2 std::unique_lock<detail::SrwSharedMutex> lock(m_hooks_mutex);
2176
1/2
✗ Branch 5 → 6 not taken.
✓ Branch 5 → 19 taken 2 times.
 2 if (m_shutdown_called.load(std::memory_order_acquire))
2177 {
2178 return {false,
2179 {{std::format("HookManager: Shutdown in progress. Cannot remove VMT hook '{}' from object.",
2180 vmt_name),
2181 ✗ LogLevel::Warning}}};
2182 }
2183
1/2
✓ Branch 19 → 20 taken 2 times.
✗ Branch 19 → 118 not taken.
 2 auto it = m_vmt_hooks.find(vmt_name);
2184
2/2
✓ Branch 22 → 23 taken 1 time.
✓ Branch 22 → 36 taken 1 time.
 2 if (it == m_vmt_hooks.end())
2185 {
2186 return {false,
2187 {{std::format("HookManager: VMT hook '{}' not found for object removal.", vmt_name),
2188
3/6
✓ Branch 26 → 27 taken 1 time.
✗ Branch 26 → 77 not taken.
✓ Branch 31 → 32 taken 1 time.
✓ Branch 31 → 33 taken 1 time.
✗ Branch 81 → 82 not taken.
✗ Branch 81 → 83 not taken.
 3 LogLevel::Warning}}};
2189 }
2190
2191
1/2
✓ Branch 38 → 39 taken 1 time.
✗ Branch 38 → 118 not taken.
 1 it->second.vmt_hook().remove(object);
2192 return {true,
2193 {{std::format("HookManager: VMT hook '{}' removed from object {}.", vmt_name,
2194 ✗ DetourModKit::Format::format_address(reinterpret_cast<uintptr_t>(object))),
2195
3/6
✓ Branch 43 → 44 taken 1 time.
✗ Branch 43 → 96 not taken.
✓ Branch 48 → 49 taken 1 time.
✓ Branch 48 → 50 taken 1 time.
✗ Branch 100 → 101 not taken.
✗ Branch 100 → 102 not taken.
 4 LogLevel::Debug}}};
2196
6/34
✗ Branch 6 → 7 not taken.
✗ Branch 6 → 68 not taken.
✓ Branch 13 → 14 taken 2 times.
✗ Branch 13 → 43 not taken.
✗ Branch 16 → 17 not taken.
✗ Branch 16 → 18 not taken.
✓ Branch 23 → 24 taken 1 time.
✗ Branch 23 → 87 not taken.
✗ Branch 33 → 34 not taken.
✓ Branch 33 → 35 taken 1 time.
✓ Branch 39 → 40 taken 1 time.
✗ Branch 39 → 109 not taken.
✓ Branch 40 → 41 taken 1 time.
✗ Branch 40 → 106 not taken.
✗ Branch 50 → 51 not taken.
✓ Branch 50 → 52 taken 1 time.
✗ Branch 65 → 66 not taken.
✗ Branch 65 → 67 not taken.
✗ Branch 69 → 70 not taken.
✗ Branch 69 → 73 not taken.
✗ Branch 71 → 72 not taken.
✗ Branch 71 → 73 not taken.
✗ Branch 84 → 85 not taken.
✗ Branch 84 → 86 not taken.
✗ Branch 88 → 89 not taken.
✗ Branch 88 → 92 not taken.
✗ Branch 90 → 91 not taken.
✗ Branch 90 → 92 not taken.
✗ Branch 103 → 104 not taken.
✗ Branch 103 → 105 not taken.
✗ Branch 110 → 111 not taken.
✗ Branch 110 → 114 not taken.
✗ Branch 112 → 113 not taken.
✗ Branch 112 → 114 not taken.
 7 }();
2197
2198
2/2
✓ Branch 31 → 18 taken 2 times.
✓ Branch 31 → 32 taken 2 times.
 6 for (const auto &entry : deferred_logs)
2199 {
2200
1/2
✓ Branch 21 → 22 taken 2 times.
✗ Branch 21 → 44 not taken.
 2 m_logger.log(entry.level, entry.msg);
2201 }
2202 2 return result;
2203
1/4
✗ Branch 32 → 33 not taken.
✓ Branch 32 → 34 taken 2 times.
✗ Branch 45 → 46 not taken.
✗ Branch 45 → 47 not taken.
 4 }
2204
2205 24 void HookManager::remove_all_vmt_hooks()
2206 {
2207
2/2
✓ Branch 3 → 4 taken 1 time.
✓ Branch 3 → 6 taken 23 times.
 24 if (get_reentrancy_guard() > 0)
2208 {
2209
1/2
✓ Branch 4 → 5 taken 1 time.
✗ Branch 4 → 30 not taken.
 1 m_logger.warning(
2210 "HookManager: Reentrant remove_all_vmt_hooks() from within a with_*/try_with_* callback rejected; "
2211 "defer hook teardown until the callback returns.");
2212 1 return;
2213 }
2214
2215
1/2
✗ Branch 7 → 8 not taken.
✓ Branch 7 → 9 taken 23 times.
 23 if (m_shutdown_called.load(std::memory_order_acquire))
2216 ✗ return;
2217
2218 ✗ std::vector<DeferredLogEntry> deferred_logs = [&]()
2219 {
2220 23 std::shared_lock<detail::SrwSharedMutex> mutator_gate(m_mutator_gate);
2221
1/2
✓ Branch 3 → 4 taken 23 times.
✗ Branch 3 → 52 not taken.
 23 std::unique_lock<detail::SrwSharedMutex> lock(m_hooks_mutex);
2222 23 std::vector<DeferredLogEntry> logs;
2223
1/2
✗ Branch 5 → 6 not taken.
✓ Branch 5 → 7 taken 23 times.
 23 if (m_shutdown_called.load(std::memory_order_acquire))
2224 {
2225 ✗ return logs;
2226 }
2227
2/2
✓ Branch 8 → 9 taken 21 times.
✓ Branch 8 → 17 taken 2 times.
 23 if (!m_vmt_hooks.empty())
2228 {
2229 21 size_t num_hooks = m_vmt_hooks.size();
2230 21 clear_vmt_hooks_locked();
2231 21 logs.push_back(
2232 {std::format("HookManager: All {} VMT hooks have been removed.", num_hooks), LogLevel::Debug});
2233 }
2234 else
2235 {
2236 2 logs.push_back(
2237 2 {"HookManager: remove_all_vmt_hooks called, but no VMT hooks were active.", LogLevel::Debug});
2238 }
2239 23 return logs;
2240
7/18
✓ Branch 9 → 10 taken 23 times.
✗ Branch 9 → 31 not taken.
✓ Branch 11 → 12 taken 21 times.
✗ Branch 11 → 36 not taken.
✓ Branch 12 → 13 taken 21 times.
✗ Branch 12 → 31 not taken.
✗ Branch 14 → 15 not taken.
✓ Branch 14 → 16 taken 21 times.
✓ Branch 19 → 20 taken 2 times.
✗ Branch 19 → 44 not taken.
✓ Branch 20 → 21 taken 2 times.
✗ Branch 20 → 39 not taken.
✗ Branch 22 → 23 not taken.
✓ Branch 22 → 24 taken 2 times.
✗ Branch 33 → 34 not taken.
✗ Branch 33 → 35 not taken.
✗ Branch 41 → 42 not taken.
✗ Branch 41 → 43 not taken.
 94 }();
2241
2242
2/2
✓ Branch 25 → 12 taken 23 times.
✓ Branch 25 → 26 taken 23 times.
 69 for (const auto &entry : deferred_logs)
2243 {
2244
1/2
✓ Branch 15 → 16 taken 23 times.
✗ Branch 15 → 32 not taken.
 23 m_logger.log(entry.level, entry.msg);
2245 }
2246 23 }
2247
2248 16 std::vector<std::string> HookManager::get_vmt_hook_names() const
2249 {
2250
1/2
✓ Branch 2 → 3 taken 16 times.
✗ Branch 2 → 22 not taken.
 16 const auto lock = lock_hooks_shared_reentrant();
2251 16 std::vector<std::string> names;
2252
1/2
✓ Branch 4 → 5 taken 16 times.
✗ Branch 4 → 18 not taken.
 16 names.reserve(m_vmt_hooks.size());
2253
2/2
✓ Branch 13 → 7 taken 7 times.
✓ Branch 13 → 14 taken 16 times.
 23 for (const auto &[name, entry] : m_vmt_hooks)
2254 {
2255
1/2
✓ Branch 10 → 11 taken 7 times.
✗ Branch 10 → 17 not taken.
 7 names.push_back(name);
2256 }
2257 16 return names;
2258 16 }
2259 } // namespace DetourModKit
2260