Detours

Each Microsoft Research group works within one of four general categories. These group pages describe how each group is contributing to those categories, what projects are in the works, who is contributing to the research, and in some cases list contributions in the form of professional conference proceedings and technical journal articles.

Detours

What's New?

We've just released version 1.2.

Overview

Detours is a library for instrumenting arbitrary Win32 functions on x86 machines. Detours intercepts Win32 functions by re-writing target function images.

Binary Instrumentation

Innovative systems research hinges on the ability to easily instrument and extend existing operating system and application functionality. With access to appropriate source code, it is often trivial to insert new instrumentation or extensions by rebuilding the OS or application. However, in today's world of commercial development, and binary-only releases systems researchers seldom have access to all relevant source code.

Detours is a library for instrumenting arbitrary Win32 functions on x86 machines. Detours intercepts Win32 functions by re-writing target function images. The Detours package also contains utilities to attach arbitrary DLLs and data segments (called payloads) to any Win32 binary.

Detours preserves the un-instrumented target function (callable through a trampoline) as a subroutine for use by the instrumentation. Our trampoline design enables a large class of inovative extendions to existing binary software.

We have used Detours to create an automatic distributed partitioning system, to instrument and analyze the DCOM protocol stack, and to create a thunking layer for a COM-based OS API.

To Download:
Before downloading our Detours package, you must read and agree to our license agreement. From there you will be taken to the registration and download area.

Publications:

Galen Hunt and Doug Brubacher. Detours: Binary Interception of Win32 Functions. To appear in Proceedings of the 3rd USENIX Windows NT Symposium. Seattle, WA, July 1999. USENIX.