Exetools - Microsoft Detours Pro v3.0

Exetools (https://forum.exetools.com/index.php)

- Source Code (https://forum.exetools.com/forumdisplay.php?f=46)

- - Microsoft Detours Pro v3.0 (https://forum.exetools.com/showthread.php?t=17371)

b30wulf

02-02-2016 09:33

Microsoft Detours Pro v3.0

2 Attachment(s)

After a couple of request on pm i have decided to share it with community.

Detours Professional includes support for either 32-bit or 64-bit processes on x86 and other Windows-compatible processors.
Detours 3.0 includes the following new features over Detours 2.x:
Support for 64-bit code on x64 and IA64 processors (Professional Edition only).
Support for all Windows processors (Professional Edition only).
Removed requirement for including detoured.dll in processes.
Compatibility improvements for detouring APIs used by managed-code (MSIL) programs, especially on x64 processors.
Addition of APIs to enumerate PE binary Imports and to determine the module referenced by a function pointer.

Password is easy to get, i didn't wanted to be just copy paste.

besoeso

02-02-2016 16:40

Is it the same share here before? Right?

http://forum.exetools.com/showpost.php?p=102344&postcount=5

FoxB	02-02-2016 23:06

both

// Microsoft Research Detours Package, Version 3.0 Build_316

b30wulf

02-03-2016 07:15

Yep, didn't notice that its all ready on forum.
Anyway now will be easier to find.

Pansemuckl

02-03-2016 10:04

Quote:

Originally Posted by b30wulf (Post 104162)

Yep, didn't notice that its all ready on forum.
Anyway now will be easier to find.

And even easier downloading here
http://ul.to/bs1r1j9j

For those who are like me member of this forum for 10+ years, and still don't have privilege to download attachments.
Come on, change these ridiculous policies. All it does is harm the forum. People seek other places to download.

Conquest

02-05-2016 12:34

Quote:

Originally Posted by Pansemuckl (Post 104163)

any mirror? ul.to isnt accessible here

FoxB	02-06-2016 14:02

http://rghost.net/6qR6LYxv5

emo	03-17-2016 00:19

this detours source code?

atom0s

03-17-2016 04:13

Quote:

Originally Posted by emo (Post 104650)

this detours source code?

Yes, Detours does not come precompiled in any edition. This includes the 32bit and 64bit code.

IChooseYou

05-11-2016 09:32

I have only used to Detours 1.5 before, and the documentation for 3.0 isn't great. So in case anyone struggles:

PHP Code:


		
			
PVOID SetDetour( PVOID* ppTarget, PVOID pHandler )

{

    if ( DetourTransactionBegin( ) != NO_ERROR )

        return FALSE;



    if ( DetourUpdateThread( GetCurrentThread( ) ) != NO_ERROR )

    {

        DetourTransactionCommit( );

        return NULL;

    }



    PDETOUR_TRAMPOLINE pTrampoline = NULL;

    

    if ( DetourAttachEx( ppTarget, pHandler, &pTrampoline, NULL, NULL ) != NO_ERROR )

    {

        DetourTransactionCommit( );

        return NULL;        

    }



    if ( DetourTransactionCommit( ) != NO_ERROR )

    {

        DetourTransactionAbort( );

        return NULL;

    }



    return pTrampoline;

}

Retouring works the same, call DetourDetach as opposed to DetourAttach/DetourAttachEx

PHP Code:


		
			
    g_lpDispatchMessage = reinterpret_cast<PVOID*>( 0x14317DCD0 );

    oDispatchMessage = reinterpret_cast<tDispatchMessage>( SetDetour( &g_lpDispatchMessage, hkDispatchMessage ) );



    RemoveDetour( &g_lpDispatchMessage, hkDispatchMessage );

user_hidden

05-11-2016 21:05

IChooseYou, that pushed me in a better direction with as you say lack of documentation in 3.0

atom0s

05-12-2016 14:42

Here is an example of hooking Win32 API without a trampoline since they are not always needed:
(Error checking code omitted for ease of reading.)

PHP Code:


		
			
extern "C"

{

    HWND (WINAPI *Real_CreateWindowExA)(DWORD, LPCSTR, LPCSTR, DWORD, int, int, int, int, HWND, HMENU, HINSTANCE, LPVOID) = CreateWindowExA;

};



/**

 * user32!CreateWindowExA detour callback.

 */

HWND __stdcall Mine_CreateWindowExA(DWORD dwExStyle, LPCSTR lpClassName, LPCSTR lpWindowName, DWORD dwStyle, int x, int y, int nWidth, int nHeight, HWND hWndParent, HMENU hMenu, HINSTANCE hInstance, LPVOID lpParam)

{

    // Do your personal alterations and such here..

    

    return Real_CreateWindowExA(dwExStyle, lpClassName, lpWindowName, dwStyle, x, y, nWidth, nHeight, hWndParent, hMenu, hInstance, lpParam);

}



// Attach the detour..

DetourTransactionBegin();

DetourUpdateThread(::GetCurrentThread());

DetourAttach(&(PVOID&)Real_CreateWindowExA, Mine_CreateWindowExA);

DetourTransactionCommit();

WhoCares

07-13-2016 11:32

so good.

I got detours 3 source code from the open source .net framework code, but there is a nasty typo bug...and finally microsoft removed the leaked code form their open source site.

mavermaver

07-13-2016 12:01

Quote:

Originally Posted by Pansemuckl (Post 104163)

Yes. It's a really ridiculous policy.

Newbie_Cracker

07-14-2016 20:03

Is it the password? It is not working for me

Quote:

01110010 00111001 00101011 01001100 01001101 00101011 01010000 01010111 01101000 01100011 01010010 01101011 00111110 00100111 01010001 00100010 01001011 01100111 01101000 01100101

niculaita

07-14-2016 20:49

use this online site to decode bin to text

http://www.roubaixinteractive.com/PlayGround/Binary_Conversion/Binary_To_Text.asp

Newbie_Cracker

07-14-2016 20:54

Quote:

Originally Posted by niculaita (Post 106119)

use this online site to decode bin to text

http://www.roubaixinteractive.com/PlayGround/Binary_Conversion/Binary_To_Text.asp

Code:

r9+LM+PWhcRk>'Q"Kghe

What is the correct password? It didn't work too !:confused:

I don't understand why he made it complicated. It seems b30wulf likes puzzles so much !

niculaita

07-15-2016 07:12

r9+LM+PWhcRk>'Q"Kghe is corect for me
use winrar v5.xx to desarchive from www.rarlab.com

Newbie_Cracker

07-15-2016 16:53

Quote:

Originally Posted by niculaita (Post 106132)

r9+LM+PWhcRk>'Q"Kghe is corect for me
use winrar v5.xx to desarchive from www.rarlab.com

Oh, mine was v5.00 beta 8.
Now the file was decompressed.

CryptXor

07-15-2016 17:20

Yeah that is the password, but rather a different form of the password.

Hint: A solid, liquid or gas are just different forms of a substance :)

I am also pretty sure this is incomplete, going by what is in the express package. Thanks for the share anyway.

xobor

07-15-2016 21:19

Quote:

Originally Posted by Newbie_Cracker (Post 106120)

Code:

r9+LM+PWhcRk>'Q"Kghe

What is the correct password? It didn't work too !:confused:

I don't understand why he made it complicated. It seems b30wulf likes puzzles so much !

complicated? not so much I guess :)

CryptXor

07-19-2016 20:19

1 Attachment(s)

Here is a bit of a Frankenstein package. I combined the pro from here with bits out of the express package to get a "more complete" pro version (i.e including syelog).

Hopefully it will be useful, and is the 2nd best thing to a full pro package :).

Download:

Code:

https://userscloud.com/ib0jgs2z7x1h

https://1fichier.com/?94rxfs3b86

https://openload.co/f/zW4nT6tvWAg/Detours_Pro_v3.0.7z

https://clicknupload.link/ttu6umlr8xkx

Password attached. Please don't just mirror the file/password.

Fyyre

07-31-2016 01:44

Quote:

Originally Posted by mavermaver (Post 106095)

Yes. It's a really ridiculous policy.

I am fairly certain x amount of posts allow you to download...

securedsolutions

11-02-2016 08:02

source code for static libraries

But are the .lib files with source code as well?

Quote:

Originally Posted by atom0s (Post 104658)

Yes, Detours does not come precompiled in any edition. This includes the 32bit and 64bit code.

atom0s

11-03-2016 11:51

Quote:

Originally Posted by securedsolutions (Post 107583)

But are the .lib files with source code as well?

It appears in the professional edition, they include pre-compiled libs. This was not the case in their past releases of Detours. So that was my mistake. I don't use/need the professional version of this so I never bothered to download and check the files included. I just went based on their previous releases in the past.

ragdog

04-07-2017 00:21

Hello

Any chance to download it without password?
I have no permission to access to donwloads.

Regards,

mrfearless

04-07-2017 05:40

MinHook - The Minimalistic x86/x64 API Hooking Library for Windows
https://github.com/TsudaKageyu/minhook

Might be useful for someone looking for something similar to detours.

mak	07-13-2017 05:15

Detours Version 3.0 Build 341

https://www.microsoft.com/en-us/down....aspx?id=52586

Date Published:
6/12/2017

espkk

08-28-2017 22:17

What happened to Detours? Now there is Detours Version 3.0 Build_343 which seems to include Pro features (and there is no mention of the Express version)

Conquest

08-29-2017 00:24

Quote:

Originally Posted by espkk (Post 110324)

What happened to Detours? Now there is Detours Version 3.0 Build_343 which seems to include Pro features (and there is no mention of the Express version)

https://www.microsoft.com/en-us/download/details.aspx?id=52586

espkk

08-29-2017 01:13

Quote:

Originally Posted by Conquest (Post 110327)

https://www.microsoft.com/en-us/download/details.aspx?id=52586

Try to download it - there is "Detours Version 3.0 Build_343" with x64 and ARM support
Previous version I had was restricted and was named "Express Version 3.0 Build_339"

TechLord

08-29-2017 08:29

Quote:

Originally Posted by espkk (Post 110329)

Try to download it - there is "Detours Version 3.0 Build_343" with x64 and ARM support
Previous version I had was restricted and was named "Express Version 3.0 Build_339"

When I download this I am getting a 512 KB file. I think that the .lib , includes and binaries folders are missing from this pack.

The "usual" Pro version should be around 8 MB in size if I recall correctly.

espkk

08-30-2017 04:32

Quote:

Originally Posted by TechLord (Post 110335)

Detours Pro build 316(from this topic) is 218kb(rar), unpacked version is about 1MB
Express version doesn't include .lib, but includes many samples instead

The main reason why I asked is that in previous versions there were regions like

Code:

#ifdef DETOURS_X64

#error Feature not supported in this release.

#else

which are replaced by working code now, e.g.

Code:

#ifdef DETOURS_X64

    // REX.W trumps 66

    else if (m_bRaxOverride) {

        nBytesFixed = nFixedSize + ((nFlagBits & RAX) ? 4 : 0);

    }

#endif

Although it has always been this way:

Quote:

Support for 64-bit code on x64 and IA64 processors (Professional Edition only).
Support for all Windows processors (Professional Edition only).

Does this mean that these features are now supported in Detours Express?
I have no access to my working PC right now so I can't check it, can someone try to compile it?

atom0s

08-30-2017 11:13

It does appear that the newest express edition includes the 64bit features of Pro. Not sure if that is intentional or not since they did not include any info on the updates and did not update the MSDN page to include this change. Could have been an accidental release of the wrong package.

zeffy

04-16-2018 09:37

Looks like Microsoft has published the Detours 4.0.1 source code and relicensed it under MIT:

https://github.com/Microsoft/Detours

atom0s

04-16-2018 12:26

Quote:

Originally Posted by zeffy (Post 113052)

Looks like Microsoft has published the Detours 4.0.1 source code and relicensed it under MIT:

https://github.com/Microsoft/Detours

Looks like this includes the 64bit code as well so seems to be intentional. Guessing they gave up trying to sell it with all the free hooking libs out now that support both 32bit/64bit.

Rikkie

06-20-2018 02:55

But I guess it is still the best lib in terms of completeness and documentation.

atom0s

06-21-2018 01:42

Quote:

Originally Posted by Rikkie (Post 113694)

But I guess it is still the best lib in terms of completeness and documentation.

Best is subjective and opinion based. There are a lot of detouring libraries made by various people that are free, open source, and support both 32bit and 64bit which you can find via Google. MS Detours was one of the first more or less publicly used ones for a while, but there are better ones available and for free.

MS used to charge a lot of money for the 64bit version of this library, which is why a bunch of others decided to code their own and then share them for free.

Something else to keep in mind is that MS Detours is detected by a lot of anti-cheats and other protection setups as it is a commonly used library, so you may run into detection issues depending on what you use it for. Some anti-virus' will also flag things that use it.

matt	06-22-2018 10:41

ARM/ARM64/IA64 supported, plus X86/X64 ! Marvelous!

Quote:

Originally Posted by zeffy (Post 113052)

Looks like Microsoft has published the Detours 4.0.1 source code and relicensed it under MIT:

https://github.com/Microsoft/Detours

All times are GMT +8. The time now is 21:36.