detour-rs
This is a cross-platform detour library developed in Rust. Beyond the basic functionality, this library handles branch redirects, RIP-relative instructions, hot-patching, NOP-padded functions, and allows the original function to be called using a trampoline whilst hooked.
This is one of few cross-platform detour libraries that exists, and to maintain this feature, not all desired functionality can be supported due to lack of cross-platform APIs. Therefore EIP relocation is not supported.
NOTE: Nightly is currently required for static_detour!
and is enabled by
default.
Platforms
This library provides CI for these targets:
- Linux
i686-unknown-linux-gnu
x86_64-unknown-linux-gnu
x86_64-unknown-linux-musl
- Windows
i686-pc-windows-gnu
i686-pc-windows-msvc
x86_64-pc-windows-gnu
x86_64-pc-windows-msvc
- macOS
i686-apple-darwin
x86_64-apple-darwin
Installation
Add this to your Cargo.toml
:
[]
= "0.8.0"
Example
- A static detour (one of three different detours):
use Error;
use static_detour;
static_detour!
- A Windows API hooking example is available here; build it by running:
$ cargo build --example messageboxw_detour
Mentions
Part of the library's external user interface was inspired by minhook-rs, created by Jascha-N, and it contains derivative code of his work.
Appendix
-
EIP relocation
Should be performed whenever a function's prolog instructions are being executed, simultaneously as the function itself is being detoured. This is done by halting all affected threads, copying the affected instructions and appending a
JMP
to return to the function. This is barely ever an issue, and never in single-threaded environments, but YMMV. -
NOP-padding
int // xor eax, eax // ret // nop // nop // ...
Functions such as this one, lacking a hot-patching area, and too small to be hooked with a 5-byte
jmp
, are supported thanks to the detection of code padding (NOP/INT3
instructions). Therefore the required amount of trailingNOP
instructions will be replaced, to make room for the detour.