microsoft/Detours
Detours
Detours is a library for intercepting Win32 API calls and redirecting function calls at runtime on Windows, enabling binary-level instrumentation without requiring access to the original source code. It functions as an API hooking library and binary instrumentation toolkit, allowing developers to monitor or modify the behavior of compiled Windows binaries by hooking into their function execution paths.
The project achieves this through detour-based function interception, where the first few instructions of a target function are replaced with a jump to a user-supplied detour function, while preserving the original bytes for optional trampoline calls. It supports export table redirection to overwrite import address table entries, payload-based hook management for chaining multiple detours on a single function, and process injection via DLL to load interception code into running processes. The library also includes a runtime code cache for trampolines, thread-safe atomic patching to prevent race conditions, and trampoline call preservation to allow detours to call the original function behavior.
Detours provides capabilities for dynamic code modification, process instrumentation, and runtime function redirection, enabling the alteration of execution paths in running Windows software. It supports binary-level code interception and Windows API hooking for debugging, analysis, or extending existing APIs without modifying the original binaries on disk.
