4 ms·

For those of us who don't Windows, can you explain what a detour is?

coldtea 3y ago
Detours is a library for instrumenting arbitrary Win32 functions Windows-compatible processors. Detours intercepts Win32 functions by re-writing the in-memory code for target functions. The Detours package also contains utilities to attach arbitrary DLLs and data segments (called payloads) to any Win32 binary. Detours preserves the un-instrumented target function (callable through a trampoline) as a subroutine for use by the instrumentation. Our trampoline design enables a large class of innovative extensions to existing binary software. https://www.microsoft.com/en-us/research/project/detours/ https://www.microsoft.com/en-us/research/project/detours/
- IshKebab 3y ago
  Interesting. Has anyone done the same thing on Linux?
  - alaxapta7 3y ago
    I use and recommend subhook[0]. [0] https://github.com/Zeex/subhook https://github.com/Zeex/subhook
- jaclaz 3y ago
  Only for the record, there is also easyhook: https://easyhook.github.io/ https://easyhook.github.io/ https://easyhook.github.io/#features https://easyhook.github.io/#features https://github.com/EasyHook/EasyHook https://github.com/EasyHook/EasyHook
  - stevemk14ebr 3y ago
    And my more sophisticated library, https://github.com/stevemk14ebr/PolyHook_2_0 https://github.com/stevemk14ebr/PolyHook_2_0
jborean93 3y ago
You essentially replace a function with your own. The project is at https://github.com/microsoft/Detours https://github.com/microsoft/Detours. I’ve created a PowerShell module that wraps this library to make it easier to hook functions on the fly for testing https://github.com/jborean93/PSDetour https://github.com/jborean93/PSDetour. For example I used it to capture TLS session data for decryption https://gist.github.com/jborean93/6c1f1b3130f2675f1618da56633eb1fa https://gist.github.com/jborean93/6c1f1b3130f2675f1618da5663... as well as create an strace like functionality for various Win32 APIs (still expanding as I find more use cases) https://github.com/jborean93/PSDetour-Hooks https://github.com/jborean93/PSDetour-Hooks
- grepfru_it 3y ago
  > as well as create an strace like functionality for various Win32 APIs Yes please. Thank you for this

Detours is a library for instrumenting arbitrary Win32 functions Windows-compatible processors. Detours intercepts Win32 functions by re-writing the in-memory code for target functions. The Detours package also contains utilities to attach arbitrary DLLs and data segments (called payloads) to any Win32 binary. Detours preserves the un-instrumented target function (callable through a trampoline) as a subroutine for use by the instrumentation. Our trampoline design enables a large class of innovative extensions to existing binary software. https://www.microsoft.com/en-us/research/project/detours/ https://www.microsoft.com/en-us/research/project/detours/

IshKebab 3y ago
Interesting. Has anyone done the same thing on Linux?
- alaxapta7 3y ago
  I use and recommend subhook[0]. [0] https://github.com/Zeex/subhook https://github.com/Zeex/subhook
jaclaz 3y ago
Only for the record, there is also easyhook: https://easyhook.github.io/ https://easyhook.github.io/ https://easyhook.github.io/#features https://easyhook.github.io/#features https://github.com/EasyHook/EasyHook https://github.com/EasyHook/EasyHook
- stevemk14ebr 3y ago
  And my more sophisticated library, https://github.com/stevemk14ebr/PolyHook_2_0 https://github.com/stevemk14ebr/PolyHook_2_0

jborean93 3y ago

You essentially replace a function with your own. The project is at https://github.com/microsoft/Detours https://github.com/microsoft/Detours. I’ve created a PowerShell module that wraps this library to make it easier to hook functions on the fly for testing https://github.com/jborean93/PSDetour https://github.com/jborean93/PSDetour. For example I used it to capture TLS session data for decryption https://gist.github.com/jborean93/6c1f1b3130f2675f1618da56633eb1fa https://gist.github.com/jborean93/6c1f1b3130f2675f1618da5663... as well as create an strace like functionality for various Win32 APIs (still expanding as I find more use cases) https://github.com/jborean93/PSDetour-Hooks https://github.com/jborean93/PSDetour-Hooks

grepfru_it 3y ago
> as well as create an strace like functionality for various Win32 APIs Yes please. Thank you for this