3 ms·
From https://www.microsoft.com/en-us/research/project/detours/ https://www.microsoft.com/en-us/research/project/detours/ "Detours is a library for instrumentin
by abainbridge 4y ago
From https://www.microsoft.com/en-us/research/project/detours/ https://www.microsoft.com/en-us/research/project/detours/
"Detours is a library for instrumenting arbitrary Win32 functions Windows-compatible processors. Detours intercepts Win32 functions by re-writing the in-memory code for target functions."
Doesn't that just re-write the DLL import table? ie it only allows interception of a Win32 API calls, not interception of my function A calling my function B?
- wheybags 4y agoNo, it inserts a jump instruction at the start of the function, and just overrides whatever is there already. To allow you to call the "original" function, it does some analysis to figure out what it's stomping on, and creates another little bootstrap function that executes that one destroyed instruction, then jumps to the second instruction of the original function. Basically: black magic
- gilnaa 4y agoIsn't this why Windows have MOV EDI, EDI at the start of a function? https://devblogs.microsoft.com/oldnewthing/20110921-00/?p=9583 https://devblogs.microsoft.com/oldnewthing/20110921-00/?p=95...
- abainbridge 4y agoNo. It sounds like Detours works even when the function hasn't got MOV EDI, EDI at the start.
- abainbridge 4y agoOh yeah, sophisticated: https://github.com/microsoft/Detours/wiki/OverviewInterception https://github.com/microsoft/Detours/wiki/OverviewIntercepti...