4 ms·
This. Just like in the ol' good days, install an API hook (e.g. with Microsoft Detours[1]) that would patch relevant functions in-memory. Microsoft cannot block
by drdaeman 5y ago
This. Just like in the ol' good days, install an API hook (e.g. with Microsoft Detours[1]) that would patch relevant functions in-memory. Microsoft cannot block this because they'll be breaking lots of existing things (automation tools, gaming overlays, AV software even).
And if MS would want to play it rough and start blocking hook DLLs with permission barriers, make this API patcher a kernel module.
[1]: https://github.com/microsoft/detours https://github.com/microsoft/detours
- dblohm7 5y agoFirefox already does Detours-style API hooking -- I was its maintainer for several years.
- nyanpasu64 5y agoWhat is the API hooking used for?
- dblohm7 5y agoMostly security and sandboxing stuff.
- bob1029 5y agoRight now, TrustedInstaller is an excellent workaround for many things.
- dataflow 5y ago> make this API patcher a kernel module You mean an unsigned one?