Hello and welcome to a new section API hooking using the Tools Library, intercepting API function calls.
What is API hugging API hooking is used to add functionality into a program where the source code is
not available.
It is also used to make modifications at runtime without modifying the actual binary.
Far in game cheats.
API hooking can be used to intercept functions with checks for player help and return 100 percent help.
For example, debugging is also use API hooking when you set breakpoints.
What do you do to us?
Detours is a library, a library use for a standing window Win32 functions.
It is created by two researchers from Microsoft Humanity published.
The article detours binary interception of Win32 functions.
So the two researchers, Galen Hund and Rebecca.
Details intercepts Win32 functions by rewriting function images.
It includes utilities to attach arbitrary details and also payloads to any Win32 binary.
This is a diagram explaining this to us calling function with and without deception.
In the first diagram type, this indicates this shows in location the intersection.
So assuming we have two functions, this source function and target function, both are residing in
the same process.
The source function is trying to call the target function, and the target function also returns results
after the execution to the source function.
Now the detours.
You can see in the bottom diagram, invocation of interception, so in the mouth, and again there is
a detour function added to a function to intercept the call mean by decisive action.
And we are in control of the detour function using a detour function.
We can do anything we want.
You can forward the call to the target function, or you can jump to another payload or do something
else, and then you can also written something back to the satisfaction.
If you wanted to pass the car to the target function vehicle, feisty parametres from the assassination,
true, the trampoline function, distance quality target function.
And all equally modify the variables in a bus to the Detour Commission, if you want to do all, we
could simply substitute it with a different function.
So the trampoline function job is merely to set the barometers at a bus from your source to lead to
a function and to forward it to the target function, and it also contains additional code.
We came from the source function after the target -- executes will return the result to the detour
function, which gets forwarded back to the source commission from the point of view of the target function.
Its other function doesn't know that it is dealing with a detour function.
Target and Templin functions before and after hooking in this again.
There are two parts on the left is before hooking and on the right after hooking.
So this is an example of a target function, and the trampoline at is not.
The target function contains the instructions that are to be executed while the trampoline function
is empty.
So after hooking, we will replace the target function as the instruction.
If we jump to the detour function.
And this jumbled definition, since he replaces all these Russians here, except for the last time,
he will need to pull back on his instructions somewhere in memory.
And that is where you use a trampoline function.
So we copy all those instructions who has been replaced by the jump down into the trampoline function
here and add the last line of temporary function.
We jump back to the original quote in the target function.
So it is jam here.
When we come back to the target function plus five plus five is because all these instructions here
take fire instructions.
So that's why you classify it so that you can get back to where you were supposed to go after the jump
returns, it is pushing.
That's why you classify so for different functions.
The number of sets here could be different.
In this case, he happens to be fight again.
He's diagram came from the article written by The Killing Hunting Duke Rebecca.
So that's all for the theoretical background of detours.
Thank you for watching.