3 ms·
No, it inserts a jump instruction at the start of the function, and just overrides whatever is there already. To allow you to call the "original" function, it d
by wheybags 4y ago
No, it inserts a jump instruction at the start of the function, and just overrides whatever is there already. To allow you to call the "original" function, it does some analysis to figure out what it's stomping on, and creates another little bootstrap function that executes that one destroyed instruction, then jumps to the second instruction of the original function.
Basically: black magic
- gilnaa 4y agoIsn't this why Windows have MOV EDI, EDI at the start of a function? https://devblogs.microsoft.com/oldnewthing/20110921-00/?p=9583 https://devblogs.microsoft.com/oldnewthing/20110921-00/?p=95...
- abainbridge 4y agoNo. It sounds like Detours works even when the function hasn't got MOV EDI, EDI at the start.
- abainbridge 4y agoOh yeah, sophisticated: https://github.com/microsoft/Detours/wiki/OverviewInterception https://github.com/microsoft/Detours/wiki/OverviewIntercepti...