samples

#include <windows.h>
#include <detours.h>

static LONG dwSlept = 0;

// Target pointer for the uninstrumented Sleep API.
//
static VOID (WINAPI * TrueSleep)(DWORD dwMilliseconds) = Sleep;

// Detour function that replaces the Sleep API.
//
VOID WINAPI TimedSleep(DWORD dwMilliseconds)
{
    // Save the before and after times around calling the Sleep API.
    DWORD dwBeg = GetTickCount();
    TrueSleep(dwMilliseconds);
    DWORD dwEnd = GetTickCount();

    InterlockedExchangeAdd(&dwSlept, dwEnd - dwBeg);
}

// DllMain function attaches and detaches the TimedSleep detour to the
// Sleep target function.  The Sleep target function is referred to
// through the TrueSleep target pointer.
//
BOOL WINAPI DllMain(HINSTANCE hinst, DWORD dwReason, LPVOID reserved)
{
    if (DetourIsHelperProcess()) {
        return TRUE;
    }

    if (dwReason == DLL_PROCESS_ATTACH) {
        DetourRestoreAfterWith();

        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourAttach(&(PVOID&)TrueSleep, TimedSleep);
        DetourTransactionCommit();
    }
    else if (dwReason == DLL_PROCESS_DETACH) {
        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourDetach(&(PVOID&)TrueSleep, TimedSleep);
        DetourTransactionCommit();
    }
    return TRUE;
}

functions

basic

• DetourTransactionBegin/创建hook任务

• DetourUpdateThread/刷新线程

• DetourAttach/DetourDetach/可以执行多次，hook/unhook多个API

  LONG DetourAttach(
    _Inout_ PVOID * ppPointer,		//Pointer to the target pointer to which the detour will be attached.
    _In_    PVOID pDetour			//Pointer to the detour function.
    );

• DetourTransactionCommit/提交hook任务

• DetourCreateProcessWithDlls/创建进程并加载特定dll

• DetourRestoreAfterWith/创建新线程后修复内存中import table

comply

• 编译环境：
  • x86 Native Tools Command Prompt for VS 2019
  • nmake.exe
  • sn.exe 强签名工具

• Detour-master目录下执行

  nmake -f ./MakeFile

  notes

• 添加头文件和静态库，与源代码放在同一文件夹下

  #include "detours.h"
  #pragma comment(lib,"detours.lib")

• 使用static类型，防止影响其他程序

  static int (WINAPI *OldMessageBox)(
          HWND hWnd,
          LPCSTR lpText,
          LPCSTR lpCaption,
          UINT uType) = MessageBox;

• 用来替换的函数原型与原函数一致

  int WINAPI NewMessageBox(
          HWND hWnd,
          LPCSTR lpText,
          LPCSTR lpCaption,
          UINT uType)
  {
          return 0;
  }

• 要在Release模式下进行调试

references

• Detours官方文档：
  • https://github.com/microsoft/detours/wiki

• Detours样例：
  • https://www.52pojie.cn/thread-580444-1-1.html
  • https://www.cnblogs.com/findumars/p/5811414.html
  • https://blog.csdn.net/u013257767/article/details/89786324

• Detours原理：
  • https://www.cnblogs.com/mayingkun/p/3872501.html

• Detours编译：
  • https://blog.csdn.net/mimica247706624/article/details/78326355

• 注意事项：
  • https://www.cnblogs.com/findumars/p/5636507.html