Available for Download
Dynamic Analysis
For Windows
Monitor and manipulate running processes in real-time. Hook functions, intercept API calls, scan memory, and observe behavior as it executes — all from a modern interface.
Capabilities
LoadedFunction Hooking
IAT, EAT, and inline hooking via MinHook. Intercept any Windows API call with minimal overhead.
Process Attachment
Attach to any running process by PID or name. Enumerate modules, threads, and memory regions.
Real-time API Monitoring
Watch Windows API calls as they happen. Log arguments, return values, and call stacks live.
Memory Scanning
Pattern-based memory search across process regions. Supports byte patterns, strings, and regex.
Modern Interface
WebView2-powered UI with real-time statistics, live hook management, and module enumeration.
C++20 Architecture
Built with modern C++20, MinHook library, and a robust ProcessManager for stable injection.
System Requirements
Windows 10 / 11 (x64)
.NET 6.0 Runtime or later
Administrator privileges
Active NiSuite subscription
Linux / macOS not supported
Technical Specifications
Internals
Platform
Windows x64
Language
C++20
UI Framework
WebView2
Hook Library
MinHook
License
Subscription
OS Support
Windows 10/11
FAQ
Common Questions
NiTools is for static analysis — it examines a binary without running it. NiHooks is for dynamic analysis — it attaches to a running process and observes behavior in real-time. They complement each other: use NiTools first to understand the structure, then NiHooks to observe execution.
Yes. NiHooks requires an active NiSuite subscription via Buy Me a Coffee. Unlike NiTools and NiWeb which have free tiers, NiHooks is subscription-only due to the complexity of maintaining the Windows binary and update infrastructure. Your subscription also unlocks unlimited scans on all other NiSuite tools.
NiHooks supports Windows 10 and Windows 11 (64-bit only). Administrator privileges are required for process attachment and API hooking. The WebView2 runtime must be installed — most Windows 11 systems have this by default. A .NET 6.0 or later runtime is also required.
Some AV products may flag process injection and hooking tools as potentially unwanted programs (PUPs) due to their dual-use nature. This is expected behavior for legitimate analysis tools. If you experience AV interference, you may need to add an exclusion for the NiHooks binary. Each release includes a SHA-256 hash for verification.
Each NiHooks release includes a SHA-256 hash displayed in your dashboard's NiHooks panel and on this page. After downloading, verify the hash with PowerShell:
Get-FileHash NiHooks.exe -Algorithm SHA256. Only download from the official link generated in your dashboard — never from third-party sites.
Authentication Required
Sign In to Access NiHooks
NiHooks requires a paid subscription. Sign in with Discord to get started.