5
There are some hooks(event triggers) availabe in Xoops files being one of them in pmlite.php if I'm not mistaken. Modules that listen to those events must follow some folder, file and class name conventions. You can start by looking into preloads folder in modules such as PM, Profile, Protector, XLanguage, Defacer. When this Xoops hooks are met during script execution, the listening methods are executed. Methods can issue redirects(as in PM module) or perform any other logic, they can also manipulate any entities that are passed as arguments by the hook. There are limited hooks in XOOPS core, there is no hook available for extending admin menus. The hooks are mainly placed in system front controllers(pmlite.php, register.php, user.php),and in bootstrap files such as common.php, header.php, and footer.php.
If you need to hack xoops core, instead of placing all your logic in the file you need to hack, you could just add a hook there, then you can build a preload to reply to that hook. It will keep upgrades easier for you. You can then propose that hook to the core team.