Microsoft Research Detours

Detours is a software package designed for monitoring and instrumenting API calls on Windows. It is used by ISVs and Microsoft product teams to intercept and redirect function calls.

Compatibility:

• Compatible with the Windows NT family: Windows NT, XP, Server 2003, 7, 8, 10, and 11.
• Limitation: It cannot be used by Windows Store apps because Detours requires APIs that are unavailable to those applications.

You can use the vcpkg dependency manager to install Detours. Follow these steps:

1. Clone the vcpkg repository.
2. Bootstrap vcpkg.
3. Integrate vcpkg with your environment.
4. Install the detours port.

git clone https://github.com/Microsoft/vcpkg.git
cd vcpkg
./bootstrap-vcpkg.sh
./vcpkg integrate install
vcpkg install detours

To build the samples manually:

1. Open a Developer Command Prompt for VS (use "X64 Native Tools Command Prompt for VS" if targeting x64; the default targets x86).
2. Change directory to the samples directory of your Detours repository.
3. Run nmake.

Note: You must build setdll and syslog first, as many other sample programs depend on them.

For detailed technical documentation, refer to the Detours Wiki.

To learn how to build and run the provided code samples, consult the README.txt file located within the samples directory of the repository.

To verify the samples, you can run tests using nmake.

• To run tests for a specific sample: Navigate to that sample's directory and run nmake test.
• To run all sample tests: Navigate to the main samples directory and run nmake test.

Note: Some samples are architecture-specific. Tests for these will be skipped if run on an unsupported architecture.

To build Detours, ensure you have the Visual Studio IDE installed with the following components:

• C/C++ tools
• Windows SDK

When cloning the repository, ensure the full path to the directory does not contain any spaces.

The trace* samples log output through the syelogd.exe daemon and hook CreateProcessW to load themselves into child processes.

You can use the withdll utility to inject a DLL into a process. For example, to run a command shell where all subsequent processes log API calls through traceapi.dll, use:

withdll -d:traceapi.dll cmd.exe