Installation

Requirements

• OS: Windows 10/11 or Windows Server 2016+
• Runtime: .NET 8.0 or .NET 10.0 (self-contained builds ship without a separate runtime)
• Privileges: Administrator recommended. Required for ETW, canary deployment to protected paths, and service/task triggers. Standard user is sufficient for static analysis and --lpe-only scans.

Build from source

git clone https://github.com/ghostvectoracademy/DLLHijackHunter.git
cd DLLHijackHunter
dotnet publish src/DLLHijackHunter/DLLHijackHunter.csproj `
    -c Release -r win-x64 --self-contained `
    -p:PublishSingleFile=true -o ./publish

The build script wraps this:

.\build.ps1

The output is a single self-contained DLLHijackHunter.exe in ./publish. No separate .NET runtime install required on the target machine.

32-bit targets

Replace -r win-x64 with -r win-x86 to build for 32-bit Windows.

MSVC note

MSVC is not required at scan time. The canary DLL engine embeds precompiled x64 and x86 canary binaries and uses runtime PE surgery for export forwarding — no compiler is invoked during a scan. If both the embedded binaries and the precompiled fallback are somehow absent, the tool falls back to cl.exe as a last resort, but this path is not exercised in normal builds.