microsoft/Detours
Detours
Detours is a library for intercepting Win32 API calls and redirecting function calls at runtime on Windows, enabling binary-level instrumentation without requiring access to the original source code. It functions as an API hooking library and binary instrumentation toolkit, allowing developers to monitor or modify the behavior of compiled Windows binaries by hooking into their function execution paths.
The project achieves this through detour-based function interception, where the first few instructions of a target function are replaced with a jump to a user-supplied detour function, while preserving the original bytes for optional trampoline calls. It supports export table redirection to overwrite import address table entries, payload-based hook management for chaining multiple detours on a single function, and process injection via DLL to load interception code into running processes. The library also includes a runtime code cache for trampolines, thread-safe atomic patching to prevent race conditions, and trampoline call preservation to allow detours to call the original function behavior.
Detours provides capabilities for dynamic code modification, process instrumentation, and runtime function redirection, enabling the alteration of execution paths in running Windows software. It supports binary-level code interception and Windows API hooking for debugging, analysis, or extending existing APIs without modifying the original binaries on disk.
Features
- API Hooking Utilities - Provides a library for hooking into Win32 API calls to monitor or modify function behavior at runtime.
- WebAssembly Function Callings - Routes calls from one function to a custom replacement, enabling instrumentation or extension of existing APIs.
- Windows API Hooking Engines - Intercepts and modifies Win32 API calls at runtime to monitor or alter application behavior without changing binaries.
- DLL Injection Techniques - Loads a user-specified DLL into a target process using CreateRemoteThread and LoadLibrary for detour installation.
- Runtime Function Entry Patching - Alters execution paths of running Windows software by patching function entry points at runtime.
- Dynamic Process Instrumentation - Injects code into running Windows processes to observe or modify internal function calls for debugging or analysis.
- Windows Process Instrumentations - Injects interception code into running Windows processes to observe or alter their API usage dynamically.
- Binary Instrumentation - Provides source-code tools for monitoring and instrumenting API calls on Windows systems.
- Instruction Rewriting - Directly modifies machine code of running processes, requiring precise x86/x64 instruction decoding and alignment.
- Function Redirection - Routes calls from original functions to custom replacements, enabling instrumentation or extension of existing APIs.
- Binary-Level Interceptions - Hooks into compiled Windows binaries to intercept function execution without requiring source code access.
- Detour-Based Interceptions - Replaces function entry instructions with jumps to detour functions, preserving original bytes for trampoline calls.
- DLL-Based Process Attachments - Injects interception code into running Windows processes to observe or alter their API usage dynamically.
- API Interception Hooks - Provides a library for hooking into Win32 API calls to monitor or modify their behavior at runtime.
- Chained Hook Payloads - Manages multiple detours on a single function through a linked list of payloads for chained interception.
- Atomic Function Patching - Uses interlocked operations to atomically replace function entry points, preventing race conditions during hook installation.
- Trampoline Call Preservations - Generates trampoline functions that re-execute overwritten instructions and jump to the original function.
- Trampoline Code Caches - Allocates executable memory pages near target functions to store trampoline code within 32-bit displacement limits.
- Import Address Table Overwrites - Overwrites import address table entries to redirect calls to detour functions without modifying original DLLs.
- Development Libraries - Library for monitoring and instrumenting Windows API calls.
