I know hooking is usually used as a technique when one would rather use external (or injected) code to manipulate an executable, vs breakpoints which are usually set by a debugging framework in an attached executable.
Why would one prefer hooking function calls rather than setting a breakpoint?
The only examples I can think of are:
- if somehow the control port used for debugging is sabotaged and you just need quick info (e.g. malware: the program is debugging itself as an anti-RE trick)
- tool preference/preferring a program/tool/automated tool that collects information rather than the tedious task of debugging an application
Can anyone think of reasons other than these?