Detours the story

I "fell" in love with detours and detouring around three years ago when I learned about them, ever since it's been a sharp weapon in my programming arsenal, but as much as I liked them I always had a problem, I learned and used Microsoft Detours, but they are not free, only if your software is non commercial, which isn't the case for me. Anyways I started to look for a solution, free, paid or information that will help me write a solution. Documentation was confusing because the concept of detouring is mixed with hooking which is a different approach and something I didn't need. I bought a library for 100$ just to find out it isn't doing what I wanted, I considered it a 100$ fee to learn how not to do it as the library was bad even for what it was suppose to do (I'm not giving any names on purpose) so I found another library which is widly known (again no names) but it requires runtimes for a language which is not MSVC (you probably know the library by now) which again is bad for me and I wanted to be able to sell my products without forcing my clients to buy licenses for 3rd party SDK which will probably come off my profits.

I've talked to a friend of mine which introduced me to detouring back in the days and he explained to me the mechanics of detouring as he was a kernel programmer and in his previous position he subvered most of the kernel. With this new knowledge I was able to build a library that does exactly what Microsoft Detour does, and because I'm intercepting only a handfull of functions I don't need to make it generic.

Time has passed, everyone was happy but I got more and more requests to support my detouring apps for 64bit, now if detours was a pain for 32bit they are a nightmare for 64bit and the reason is that MS excluded two important features that are required to perform detours:

• Naked __declspec
• __asm

Without these two, detouring would be a nightmare, so again I researched the web and just like before I went down the same path: MS Detours professional supports 64bit but costs quite a lot (last time I saw a price it was 10k$), and it can't be downloaded so I couldn't learn what they are doing. The non MSVC library doesn't support 64bit detours because there isn't a 64bit version of the development language, and the 100$ library, well, it was bad and nothing changed about it :)

The only difference is that I know how the 32bit detours work, so I researched again on the subject and again documentation is scarce and fuzzy but in a moment of insomnia I managed to find a solution for the problems with 64bit detours :) my code is working and just like before I need to make sure it works for all my detours but the hard work is done, I can safely say that as for this moment, my company is one of the handfull that are in possesion of such technology.

Just to be fair and unbiased there's another LGPL (I hate L/GPL) library which is doing kernel hooking which is quite of an overkill for me and I couldn't learn anything from it, it's called: EasyHook.