Detours | software package for monitoring and instrumenting API calls

My DLL gets injected into a program and then hooks to connect, send, recv and closesocket functions using Detours. The point is to stop the program from connecting to some server and instead communicate with my DLL directly.

My recv function uses an infinite loop, just waiting for any data to send to the program. When closesocket is called that loop is broken and everything works fine.

But there's one program written in C# that just hangs when I close it. Its error log says:

SocketException: A request to send or receive data was disallowed because the socket is not connected and (when sending on a datagram socket using a sendto call) no address was supplied.

at System.Net.Sockets.Socket.Disconnect (Boolean reuseSocket) [0x00000] in :0

The exception is expected since the socket never connects to anything. But is there any workaround for this? What does System.Net.Sockets.Socket.Disconnect call under the hood? What other function do I need to hook to detect that?

I've tried hooking to shutdown, setsockopt, WSACancelBlockingCall, WSACleanup, WSASend, WSASendDisconnect, WSASendMsg, WSASendTo, WSARecv, WSARecvDisconnect and WSARecvFrom. None of them get called.

I am trying to use the detours library in a visual studio empty windows project. I cloned the repository (https://github.com/microsoft/Detours), I added the include directory into Project Properties / C/C++ / Additional Include Directories, and I added the lib.X86 directory into Project Properties / Linker / Additional Library Directories. I get no errors visible on the file, but when I build I get

This is the code:

I'm trying to write a DLL file that I can inject into a game. I'm pretty far but when I try to compile the code I always get the error

I am trying to hook a user-defined function of a program written in Delphi using C++ and Detours library. (DLL Injection)

However, I can't hook it because Delphi's and C++'s function calling conventions don't match.

Delphi uses the fastcall function calling convention, and C++ also provides a fastcall function calling convention.

However, Delphi's fastcall stores its arguments sequentially on EAX, EDX, ECX, and the stack, whereas C++'s fastcall stores its arguments sequentially on ECX, EDX, and stack. (This is because there is no standard for fastcall.)

Due to these differences, I have no way to get the arguments stored in EAX.

How can I solve this problem?

(This article has been translated by Google Translate.)

< dllmain.cpp >

I am trying to hook a user-defined function. (via DLL injection and inline function hooking)
To do that, I need to get the address of the function to hook in process memory.

I tried various methods to find the address, and finally came up with the equation below.

(offset) = (Address of function in EXE file) - (Image base of EXE file)

(Address of function in process memory) = (GetModuleHandle(NULL)) + (offset)

However, I am not sure if this equation always holds. (For example, when DLL Relocation occurs, I am worried that this equation may be wrong.)

In conclusion, I want to know whether this equation always holds. And if not, I'd like to know how to fix this equation.

(This article has been translated by Google Translate.)

< testwinapi / main.cpp >

I want to hook the Bitblt function with the Detours library.

https://github.com/microsoft/Detours/blob/master/samples/simple/simple.cpp

By referring to the example source above, I succeeded in creating a dll that hooks the Bitblt function, but the unhooking does not work properly.

I want the original function to be restored when the dll is detached from the target process, but the DetourDetach function throws an ERROR_INVALID_BLOCK error, and access violation of the target process occurs.

How can I fix this error?

Below is the source code I wrote.

I've got a custom implementation of detours on macOS and a test application using it, which is written in C, compiled for macOS x86_64, running on an Intel i9 processor.

The implemention works fine with a multitude of functions. However, if I detour pthread_create, I encounter strange behaviour: threads that have been spawned via a detoured pthread_create do not execute instructions. I can step through instructions one by one but as soon as I continue it does not progress. There are no mutexes or synchronisation involved and the result of the function is 0 (success). The exact same application with detours turned off works fine so it's unlikely to be the culprit.

This does not happen all the time - sometimes they are fine but at other times the test applications stalls in the following state:

In Microsoft Detours Library, they do: const ULONG DETOUR_REGION_SIGNATURE = 'Rrtd';

I'm trying to figure out exactly WHY they do this. When I print it on my system it prints: 1383232612

which is the same as: (0x52 << 24) | (0x72 << 16) | (0x74 << 8) | 0x64 or ('R' << 24) + ('r' << 16) + ('t' << 8) + 'd'

Why do they do this? I read it's not portable and depends entirely on the endianness of the system and it gives warnings when compiling with GCC and Clang..