I would like to alter the behavior of some executable (in my case, a videogame). One way of doing this is to hook function calls (e.g., a function like Player::ReceiveDamage) and adjust parameters/return values.

I know how to inject code and how to hook functions. The challenge currently is to find the address of the function of interest. The source code of the target is not available, neither are debug symbols.

An approach I successfully used before is the following:

1. Find all function addresses in the target executable (e.g., with IDA, radare2, Pyew, ...)
2. With the executable running, hook all functions
3. Black-list (and un-hook) functions that are called during moments that are not of interest
4. White-list functions that are called during moments of interest
5. Repeat steps (4,5) until function list is narrowed down sufficiently

Unfortunately, I have misplaced the code I was using for this process. I can re-write it, but I noticed that there is already an enormous offering of tools and libraries that may do exactly what I need.

Performance is a challenge: logging all function calls in a videogame introduces significant overhead. I noticed previously that it would take some time for my old tool to black-list enough irrelevant functions for the target to become responsive. This likely makes Frida not a good choice, as it injects javascript.

Does anyone know of a performant tool/library, supporting Windows and x64, that I can use to find functions of interest in a target executable?