detour-rs
This is a cross-platform detour library developed in Rust. Beyond the basic functionality, this library handles branch redirects, RIP-relative instructions, hot-patching, NOP-padded functions, and allows the original function to be called using a trampoline whilst hooked.
This is one of few cross-platform detour libraries that exists, and to maintain this feature, not all desired functionality can be supported due to lack of cross-platform APIs. Therefore EIP relocation is not supported.
NOTE: Nightly is currently required for static_detours!
.
Platforms
x86/x64
: Windows, Linux & macOS.ARM
: Not implemented, but foundation exists.
Installation
Add this to your Cargo.toml
:
[]
= "0.6.0"
... and this to your crate root:
extern crate detour;
Example
- A static detour (one of three different detours):
extern crate detour;
extern "C"
static_detours!
Mentions
Part of the library's external user interface was inspired by minhook-rs, created by Jascha-N, and it contains derivative code of his work.
Appendix
-
EIP relocation
Should be performed whenever a function's prolog instructions are being executed, simultaneously as the function itself is being detoured. This is done by halting all affected threads, copying the related instructions and appending a
JMP
to return to the function. This is barely ever an issue, and never in single-threaded environments, but YMMV. -
NOP-padding
int // xor eax, eax // ret // nop // nop // ...
Functions such as this one, lacking a hot-patching area, and too small to be hooked with a 5-byte
jmp
, are supported thanks to the detection of code padding (NOP/INT3
instructions). Therefore the required amount of trailingNOP
instructions will be replaced, to make room for the detour.