Exetools - Microsoft Detours Pro v3.0

Exetools (https://forum.exetools.com/index.php)

- Source Code (https://forum.exetools.com/forumdisplay.php?f=46)

- - Microsoft Detours Pro v3.0 (https://forum.exetools.com/showthread.php?t=17371)

Quote:

Originally Posted by Conquest (Post 110327)

https://www.microsoft.com/en-us/download/details.aspx?id=52586

Try to download it - there is "Detours Version 3.0 Build_343" with x64 and ARM support
Previous version I had was restricted and was named "Express Version 3.0 Build_339"

Quote:

Originally Posted by espkk (Post 110329)

Try to download it - there is "Detours Version 3.0 Build_343" with x64 and ARM support
Previous version I had was restricted and was named "Express Version 3.0 Build_339"

When I download this I am getting a 512 KB file. I think that the .lib , includes and binaries folders are missing from this pack.

The "usual" Pro version should be around 8 MB in size if I recall correctly.

Quote:

Originally Posted by TechLord (Post 110335)

Detours Pro build 316(from this topic) is 218kb(rar), unpacked version is about 1MB
Express version doesn't include .lib, but includes many samples instead

The main reason why I asked is that in previous versions there were regions like

Code:

#ifdef DETOURS_X64

#error Feature not supported in this release.

#else

which are replaced by working code now, e.g.

Code:

#ifdef DETOURS_X64

    // REX.W trumps 66

    else if (m_bRaxOverride) {

        nBytesFixed = nFixedSize + ((nFlagBits & RAX) ? 4 : 0);

    }

#endif

Although it has always been this way:

Quote:

Support for 64-bit code on x64 and IA64 processors (Professional Edition only).
Support for all Windows processors (Professional Edition only).

Does this mean that these features are now supported in Detours Express?
I have no access to my working PC right now so I can't check it, can someone try to compile it?

It does appear that the newest express edition includes the 64bit features of Pro. Not sure if that is intentional or not since they did not include any info on the updates and did not update the MSDN page to include this change. Could have been an accidental release of the wrong package.

Looks like Microsoft has published the Detours 4.0.1 source code and relicensed it under MIT:

https://github.com/Microsoft/Detours

Quote:

Originally Posted by zeffy (Post 113052)

Looks like Microsoft has published the Detours 4.0.1 source code and relicensed it under MIT:

https://github.com/Microsoft/Detours

Looks like this includes the 64bit code as well so seems to be intentional. Guessing they gave up trying to sell it with all the free hooking libs out now that support both 32bit/64bit.

But I guess it is still the best lib in terms of completeness and documentation.

Quote:

Originally Posted by Rikkie (Post 113694)

But I guess it is still the best lib in terms of completeness and documentation.

Best is subjective and opinion based. There are a lot of detouring libraries made by various people that are free, open source, and support both 32bit and 64bit which you can find via Google. MS Detours was one of the first more or less publicly used ones for a while, but there are better ones available and for free.

MS used to charge a lot of money for the 64bit version of this library, which is why a bunch of others decided to code their own and then share them for free.

Something else to keep in mind is that MS Detours is detected by a lot of anti-cheats and other protection setups as it is a commonly used library, so you may run into detection issues depending on what you use it for. Some anti-virus' will also flag things that use it.

ARM/ARM64/IA64 supported, plus X86/X64 ! Marvelous!

Quote:

Originally Posted by zeffy (Post 113052)

Looks like Microsoft has published the Detours 4.0.1 source code and relicensed it under MIT:

https://github.com/Microsoft/Detours