Detour
Hi , can anyone explain how a detour works and what is it for?
HelpDetour
why don't u use google for that ,........ that's not very hard ....
You need to learn a language how C++ and Assembler to understand the hooking scene.
A detour make only a jump to your function in a function where you set the detour.
B8 Detour make the jmp address in to the eax register and then jump to eax.
MOV EAX
JMP EAX
The B8 is only the opcode by MOV EAX,0x00000000
or the
E9 Detour
Only
JMP 0x00000000
A detour make only a jump to your function in a function where you set the detour.
B8 Detour make the jmp address in to the eax register and then jump to eax.
MOV EAX
JMP EAX
The B8 is only the opcode by MOV EAX,0x00000000
or the
E9 Detour
Only
JMP 0x00000000
Just google for it:
API Hooking with MS Detours - CodeProject
API Hooking with MS Detours - CodeProject
Thanks guys , I Cant find it on google so I asked help here Thanks
!
!Search for how to make "codecave" instead of detour.
Detour = "making the program detour it's normal execution path by making it jmp somewhere else.
Ie. actually writing the JMP + address instruction. This is pointless without having a valid code-area to jump to. (generally a codecave).
1. Allocate codecave (or find space big enough for one)
2. Write our source into codecave
3. Write a JMP instruction somewhere in the process that will, at some point, get executed --> causing a jump to our codecave
note: the code-cave must jump back to the original location (..or at least some valid area..) of course.
The point is so you can run some of your own code from inside the process, as if it was original to the process.
edit: ^^ Most of the time. I guess you could simply use it to jump over existing code, never going to a codecave - all depends I suppose.
Detour = "making the program detour it's normal execution path by making it jmp somewhere else.
Ie. actually writing the JMP + address instruction. This is pointless without having a valid code-area to jump to. (generally a codecave).
1. Allocate codecave (or find space big enough for one)
2. Write our source into codecave
3. Write a JMP instruction somewhere in the process that will, at some point, get executed --> causing a jump to our codecave
note: the code-cave must jump back to the original location (..or at least some valid area..) of course.
The point is so you can run some of your own code from inside the process, as if it was original to the process.
edit: ^^ Most of the time. I guess you could simply use it to jump over existing code, never going to a codecave - all depends I suppose.
This thread is closed for replies.
