- Uses Microsoft Detours to intercept functions
Detour.exe
injects a dllDetouredApis.dll
into target process which hooks APIs- Logs are emitted using
OutputDebugString
and can be viewed using Sysinternals DebugView
- clone the repo
- setup vcpkg as described here
- open the solution on VS 22, and hit
Ctrl+Shift+B
to build
Detour.exe <targetprocess.exe> detouredapis.dll
- e.g.:
Detour.exe" PerfCounterCpp.exe DetouredApis.dll
- it expects the dll
detouredapis.dll
to be in the same directory asDetour.exe
- If there are more instances of target exe, only one will be picked