Ms detours portable#
Ms detours software#

3).ĭifferent file extensions are used for PE files: EXE, DLL, SCR. It is an extension of the old COFF format ( p.

Ms detours portable#

The file format of binary executable files on Windows is called Portable Executable (short: PE). The Basic Layout of Portable Executable (PE) At first, we must clarify their meanings to help the reader to understand the concepts. Within this article, some basic vocabulary from the executable file format of Windows and the reverse engineering context is used. You can reproduce all execution results of these scripts at this platform: TRANScurity Platform Getting Started In order to extract the executable file contents that are of interest, I'm going to use TypeScript-based code snippets accepted by a special web platform which is concerned with low-level detail analysis of executable files. Static hooking of an existing PE file (non-execution time) can be performed by Microsoft Detours as well, as described at: The executable file example is taken from the source code package from the original Detours project on GitHub. We will inspect and analyze the modified and added contents within the resulting file and their purpose. This article focuses on a technical view according to the modifications Microsoft Detours performs on executable files, if you use it to adjust the file statically before runtime. These all are use cases, where Microsoft Detours may help you to influence what happens when you invoke that external library.

Ms detours software#

įor what is this useful? In application programming, when you rely on external libraries, you sometimes need to debug the general program flow behavior, but what if you don't have access to the library's source code? Or another case: Imagine, your software imports external libraries (where you are not able to modify their source code) but it's necessary to adjust the behavior of specific functions? Or what if there occur errors within your application in production mode at your customer, and you want to log function calls belatedly without re-compiling the application? ( p. Microsoft Detours allows to forward calls of imported symbols to a customized external DLL which intercepts the invocation and finally forwards to the original destination of the call.

This can be performed either without modification of the original file (hooking at execution time), or by specific manipulations of the original file (statically). Microsoft Detours allows hooking function calls of imported symbols during execution time of Portable Executable files.