initial commit

.gitignore

@@ -0,0 +1,3 @@
+.vs/
+*.VC.db
+Bin/

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "Detours"]
+	path = Detours
+	url = https://github.com/Microsoft/Detours

DetoursNT.sln

@@ -0,0 +1,51 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio 15
+VisualStudioVersion = 15.0.28010.0
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "DetoursNT", "DetoursNT\DetoursNT.vcxproj", "{C78B9003-FC49-4BBF-8F29-52FAD48BB58A}"
+EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "SampleHookDLL", "SampleHookDLL\SampleHookDLL.vcxproj", "{6266D1B7-DD83-4A79-B7F3-DA8099BBAB1B}"
+EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Sample", "Sample\Sample.vcxproj", "{113B23FE-32D7-4D79-8A74-119BC11C25E2}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|x64 = Debug|x64
+		Debug|x86 = Debug|x86
+		Release|x64 = Release|x64
+		Release|x86 = Release|x86
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{C78B9003-FC49-4BBF-8F29-52FAD48BB58A}.Debug|x64.ActiveCfg = Debug|x64
+		{C78B9003-FC49-4BBF-8F29-52FAD48BB58A}.Debug|x64.Build.0 = Debug|x64
+		{C78B9003-FC49-4BBF-8F29-52FAD48BB58A}.Debug|x86.ActiveCfg = Debug|Win32
+		{C78B9003-FC49-4BBF-8F29-52FAD48BB58A}.Debug|x86.Build.0 = Debug|Win32
+		{C78B9003-FC49-4BBF-8F29-52FAD48BB58A}.Release|x64.ActiveCfg = Release|x64
+		{C78B9003-FC49-4BBF-8F29-52FAD48BB58A}.Release|x64.Build.0 = Release|x64
+		{C78B9003-FC49-4BBF-8F29-52FAD48BB58A}.Release|x86.ActiveCfg = Release|Win32
+		{C78B9003-FC49-4BBF-8F29-52FAD48BB58A}.Release|x86.Build.0 = Release|Win32
+		{6266D1B7-DD83-4A79-B7F3-DA8099BBAB1B}.Debug|x64.ActiveCfg = Debug|x64
+		{6266D1B7-DD83-4A79-B7F3-DA8099BBAB1B}.Debug|x64.Build.0 = Debug|x64
+		{6266D1B7-DD83-4A79-B7F3-DA8099BBAB1B}.Debug|x86.ActiveCfg = Debug|Win32
+		{6266D1B7-DD83-4A79-B7F3-DA8099BBAB1B}.Debug|x86.Build.0 = Debug|Win32
+		{6266D1B7-DD83-4A79-B7F3-DA8099BBAB1B}.Release|x64.ActiveCfg = Release|x64
+		{6266D1B7-DD83-4A79-B7F3-DA8099BBAB1B}.Release|x64.Build.0 = Release|x64
+		{6266D1B7-DD83-4A79-B7F3-DA8099BBAB1B}.Release|x86.ActiveCfg = Release|Win32
+		{6266D1B7-DD83-4A79-B7F3-DA8099BBAB1B}.Release|x86.Build.0 = Release|Win32
+		{113B23FE-32D7-4D79-8A74-119BC11C25E2}.Debug|x64.ActiveCfg = Debug|x64
+		{113B23FE-32D7-4D79-8A74-119BC11C25E2}.Debug|x64.Build.0 = Debug|x64
+		{113B23FE-32D7-4D79-8A74-119BC11C25E2}.Debug|x86.ActiveCfg = Debug|Win32
+		{113B23FE-32D7-4D79-8A74-119BC11C25E2}.Debug|x86.Build.0 = Debug|Win32
+		{113B23FE-32D7-4D79-8A74-119BC11C25E2}.Release|x64.ActiveCfg = Release|x64
+		{113B23FE-32D7-4D79-8A74-119BC11C25E2}.Release|x64.Build.0 = Release|x64
+		{113B23FE-32D7-4D79-8A74-119BC11C25E2}.Release|x86.ActiveCfg = Release|Win32
+		{113B23FE-32D7-4D79-8A74-119BC11C25E2}.Release|x86.Build.0 = Release|Win32
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+	GlobalSection(ExtensibilityGlobals) = postSolution
+		SolutionGuid = {BA5AF7B8-B47F-4688-BAF8-DDD1AEDC6200}
+	EndGlobalSection
+EndGlobal

DetoursNT/DetoursNT.cpp

@@ -0,0 +1,718 @@
+#define _ARM_WINAPI_PARTITION_DESKTOP_SDK_AVAILABLE 1
+#include <windows.h>
+
+#include "DetoursNT.h"
+
+// #define DETOURSNT_NO_EH
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#pragma region CRT
+
+#pragma function(memset)
+void* __cdecl
+memset(
+  void* dest,
+  int ch,
+  size_t count
+  )
+{
+  if (count)
+  {
+    char* d = (char*)dest;
+
+    do
+    {
+      *d++ = ch;
+    } while (--count);
+  }
+
+  return dest;
+}
+
+#pragma function(memcpy)
+void* __cdecl
+memcpy(
+  void* dest,
+  const void* src,
+  size_t count
+  )
+{
+  char* d = (char*)dest;
+  char* s = (char*)src;
+
+  while (count--)
+  {
+    *d++ = *s++;
+  }
+
+  return dest;
+}
+
+//
+// TODO: Use RtlCreateHeap/RtlAllocateHeap/RtlFreeHeap?
+//
+
+void* __cdecl
+malloc(
+  size_t size
+  )
+{
+  return VirtualAlloc(NULL, size, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
+}
+
+void* __cdecl
+calloc(
+  size_t count,
+  size_t size
+  )
+{
+  //
+  // UNIMPLEMENTED
+  //
+  return NULL;
+}
+
+void* __cdecl
+realloc(
+  void* ptr,
+  size_t new_size
+  )
+{
+  //
+  // UNIMPLEMENTED
+  //
+  return NULL;
+}
+
+void __cdecl
+free(
+  void* ptr
+  )
+{
+  VirtualFree(ptr, 0, MEM_RELEASE);
+}
+
+#ifdef __cplusplus
+
+} // extern "C"
+
+void* __cdecl
+operator new(
+  size_t size
+  )
+{
+  return malloc(size);
+}
+
+void* __cdecl
+operator new[](
+  size_t size
+  )
+{
+  return malloc(size);
+}
+
+void __cdecl
+operator delete(
+  void* pointer
+  ) noexcept
+{
+  free(pointer);
+}
+
+void __cdecl
+operator delete(
+  void* pointer,
+  size_t
+  ) noexcept
+{
+  free(pointer);
+}
+
+void __cdecl
+operator delete[](
+  void* pointer
+  ) noexcept
+{
+  free(pointer);
+}
+
+void __cdecl
+operator delete[](
+  void* pointer,
+  size_t
+  ) noexcept
+{
+  free(pointer);
+}
+
+extern "C" {
+
+#endif
+
+#ifndef D
+
+typedef struct _ANSI_STRING {
+  USHORT Length;
+  USHORT MaximumLength;
+  PSTR   Buffer;
+} ANSI_STRING;
+typedef ANSI_STRING *PANSI_STRING;
+
+typedef struct _UNICODE_STRING {
+  USHORT Length;
+  USHORT MaximumLength;
+  PWSTR  Buffer;
+} UNICODE_STRING;
+typedef UNICODE_STRING *PUNICODE_STRING;
+
+#define RTL_CONSTANT_STRING(s) { sizeof(s)-sizeof((s)[0]), sizeof(s), s }
+
+NTSTATUS
+NTAPI
+LdrLoadDll(
+  IN PWSTR SearchPath OPTIONAL,
+  IN PULONG DllCharacteristics OPTIONAL,
+  IN PUNICODE_STRING DllName,
+  OUT PVOID *BaseAddress
+  );
+
+NTSTATUS
+NTAPI
+LdrGetProcedureAddress(
+  IN PVOID BaseAddress,
+  IN PANSI_STRING Name,
+  IN ULONG Ordinal,
+  OUT PVOID *ProcedureAddress
+  );
+
+#ifdef _M_AMD64
+
+EXCEPTION_DISPOSITION
+__cdecl
+__C_specific_handler(
+  _In_ struct _EXCEPTION_RECORD* ExceptionRecord,
+  _In_ void* EstablisherFrame,
+  _Inout_ struct _CONTEXT* ContextRecord,
+  _Inout_ struct _DISPATCHER_CONTEXT* DispatcherContext
+  )
+{
+#if 0
+  typedef EXCEPTION_DISPOSITION (__cdecl * pfn__C_specific_handler)(
+    _In_ struct _EXCEPTION_RECORD* ExceptionRecord,
+    _In_ void* EstablisherFrame,
+    _Inout_ struct _CONTEXT* ContextRecord,
+    _Inout_ struct _DISPATCHER_CONTEXT* DispatcherContext
+    );
+
+  static pfn__C_specific_handler Procedure = NULL;
+
+  if (!Procedure)
+  {
+    PVOID NtdllImageBase;
+    RtlPcToFileHeader((PVOID)NtAllocateVirtualMemory, &NtdllImageBase);
+
+    ANSI_STRING ProcedureName = RTL_CONSTANT_STRING("__C_specific_handler");
+    LdrGetProcedureAddress(NtdllImageBase, &ProcedureName, 0, (PVOID*)&Procedure);
+
+    //
+    // Do not check for errors, if Procedure remains NULL, we're screwed anyway.
+    //
+  }
+
+  return Procedure(ExceptionRecord, EstablisherFrame, ContextRecord, DispatcherContext);
+#else
+#ifdef _DEBUG
+  __debugbreak();
+#endif
+
+  *reinterpret_cast<void**>(nullptr) = nullptr;
+
+  return (EXCEPTION_DISPOSITION)0;
+#endif
+}
+
+#endif // _M_IA64
+
+#if _M_IX86
+
+int
+_callnewh(
+  size_t size
+  )
+{
+  return 0;
+}
+
+EXCEPTION_DISPOSITION
+__cdecl
+_except_handler3(
+  _In_ struct _EXCEPTION_RECORD* ExceptionRecord,
+  _In_ void* EstablisherFrame,
+  _Inout_ struct _CONTEXT* ContextRecord,
+  _Inout_ struct _DISPATCHER_CONTEXT* DispatcherContext
+  )
+{
+#ifdef _DEBUG
+  __debugbreak();
+#endif
+
+  *reinterpret_cast<void**>(nullptr) = nullptr;
+
+  return (EXCEPTION_DISPOSITION)0;
+}
+
+#endif // _M_IX86
+
+#endif // D
+
+#pragma endregion
+
+#pragma region Detours/module.cpp
+
+ULONG WINAPI DetourGetModuleSize(_In_opt_ HMODULE hModule)
+{
+    PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)hModule;
+    if (hModule == NULL) {
+        // pDosHeader = (PIMAGE_DOS_HEADER)GetModuleHandleW(NULL);
+        pDosHeader = &__ImageBase;
+    }
+
+    __try {
+#pragma warning(suppress:6011) // GetModuleHandleW(NULL) never returns NULL.
+        if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE) {
+            SetLastError(ERROR_BAD_EXE_FORMAT);
+            return 0;
+        }
+
+        PIMAGE_NT_HEADERS pNtHeader = (PIMAGE_NT_HEADERS)((PBYTE)pDosHeader +
+                                                          pDosHeader->e_lfanew);
+        if (pNtHeader->Signature != IMAGE_NT_SIGNATURE) {
+            SetLastError(ERROR_INVALID_EXE_SIGNATURE);
+            return 0;
+        }
+        if (pNtHeader->FileHeader.SizeOfOptionalHeader == 0) {
+            SetLastError(ERROR_EXE_MARKED_INVALID);
+            return 0;
+        }
+        SetLastError(NO_ERROR);
+
+        return (pNtHeader->OptionalHeader.SizeOfImage);
+    }
+    __except(GetExceptionCode() == EXCEPTION_ACCESS_VIOLATION ?
+             EXCEPTION_EXECUTE_HANDLER : EXCEPTION_CONTINUE_SEARCH) {
+        SetLastError(ERROR_EXE_MARKED_INVALID);
+        return 0;
+    }
+}
+
+#pragma endregion
+
+#pragma region KERNEL32.DLL
+
+#define NT_SUCCESS(Status)        (((NTSTATUS)(Status)) >= 0)
+
+NTSYSAPI
+ULONG
+NTAPI
+RtlNtStatusToDosError(
+  _In_ NTSTATUS Status
+  );
+
+#define _CLIENT_ID  Mock__CLIENT_ID
+#define CLIENT_ID   Mock_CLIENT_ID
+#define PCLIENT_ID  Mock_PCLIENT_ID
+
+// #define _TEB        Mock__TEB
+// #define TEB         Mock_TEB
+// #define PTEB        Mock_PTEB
+
+typedef struct _CLIENT_ID
+{
+  HANDLE UniqueProcess;
+  HANDLE UniqueThread;
+} CLIENT_ID, *PCLIENT_ID;
+
+typedef struct _TEB
+{
+  NT_TIB    Tib;
+  PVOID     EnvironmentPointer;
+  CLIENT_ID ClientId;
+} TEB, *PTEB;
+
+static DWORD g_LastError = 0;
+
+DWORD
+WINAPI
+GetLastError(
+  VOID
+  )
+{
+  return g_LastError;
+}
+
+VOID
+WINAPI
+SetLastError(
+  IN DWORD dwErrCode
+  )
+{
+  g_LastError = dwErrCode;
+}
+
+DWORD
+WINAPI
+BaseSetLastNTError(IN NTSTATUS Status)
+{
+  DWORD dwErrCode;
+
+  /* Convert from NT to Win32, then set */
+  dwErrCode = RtlNtStatusToDosError(Status);
+  SetLastError(dwErrCode);
+  return dwErrCode;
+}
+
+DWORD
+WINAPI
+GetCurrentThreadId(
+  VOID
+  )
+{
+  return HandleToUlong(NtCurrentTeb()->ClientId.UniqueThread);
+}
+
+LPVOID
+NTAPI
+VirtualAlloc(
+  IN LPVOID lpAddress,
+  IN SIZE_T dwSize,
+  IN DWORD flAllocationType,
+  IN DWORD flProtect
+  )
+{
+  /* Call the extended API */
+  return VirtualAllocEx(GetCurrentProcess(),
+                        lpAddress,
+                        dwSize,
+                        flAllocationType,
+                        flProtect);
+}
+
+LPVOID
+NTAPI
+VirtualAllocEx(
+  IN HANDLE hProcess,
+  IN LPVOID lpAddress,
+  IN SIZE_T dwSize,
+  IN DWORD flAllocationType,
+  IN DWORD flProtect
+  )
+{
+  NTSTATUS Status;
+
+  /* Handle any possible exceptions */
+  __try
+  {
+    /* Allocate the memory */
+    Status = NtAllocateVirtualMemory(hProcess,
+                                     &lpAddress,
+                                     0,
+                                     &dwSize,
+                                     flAllocationType,
+                                     flProtect);
+  }
+  __except (EXCEPTION_EXECUTE_HANDLER)
+  {
+    Status = GetExceptionCode();
+  }
+
+  /* Check for status */
+  if (!NT_SUCCESS(Status))
+  {
+    /* We failed */
+    BaseSetLastNTError(Status);
+    return NULL;
+  }
+
+  /* Return the allocated address */
+  return lpAddress;
+}
+
+BOOL
+NTAPI
+VirtualFree(
+  IN LPVOID lpAddress,
+  IN SIZE_T dwSize,
+  IN DWORD dwFreeType
+  )
+{
+  /* Call the extended API */
+  return VirtualFreeEx(GetCurrentProcess(),
+                       lpAddress,
+                       dwSize,
+                       dwFreeType);
+}
+
+BOOL
+NTAPI
+VirtualFreeEx(
+  IN HANDLE hProcess,
+  IN LPVOID lpAddress,
+  IN SIZE_T dwSize,
+  IN DWORD dwFreeType
+  )
+{
+  NTSTATUS Status;
+
+  /* Validate size and flags */
+  if (!(dwSize) || !(dwFreeType & MEM_RELEASE))
+  {
+    /* Free the memory */
+    Status = NtFreeVirtualMemory(hProcess,
+                                 &lpAddress,
+                                 &dwSize,
+                                 dwFreeType);
+    if (!NT_SUCCESS(Status))
+    {
+      /* We failed */
+      BaseSetLastNTError(Status);
+      return FALSE;
+    }
+
+    /* Return success */
+    return TRUE;
+  }
+
+  /* Invalid combo */
+  BaseSetLastNTError(STATUS_INVALID_PARAMETER);
+  return FALSE;
+}
+
+BOOL
+NTAPI
+VirtualProtect(
+  IN LPVOID lpAddress,
+  IN SIZE_T dwSize,
+  IN DWORD flNewProtect,
+  OUT PDWORD lpflOldProtect
+  )
+{
+  /* Call the extended API */
+  return VirtualProtectEx(GetCurrentProcess(),
+                          lpAddress,
+                          dwSize,
+                          flNewProtect,
+                          lpflOldProtect);
+}
+
+BOOL
+NTAPI
+VirtualProtectEx(
+  IN HANDLE hProcess,
+  IN LPVOID lpAddress,
+  IN SIZE_T dwSize,
+  IN DWORD flNewProtect,
+  OUT PDWORD lpflOldProtect
+  )
+{
+  NTSTATUS Status;
+
+  /* Change the protection */
+  Status = NtProtectVirtualMemory(hProcess,
+                                  &lpAddress,
+                                  &dwSize,
+                                  flNewProtect,
+                                  (PULONG)lpflOldProtect);
+  if (!NT_SUCCESS(Status))
+  {
+    /* We failed */
+    BaseSetLastNTError(Status);
+    return FALSE;
+  }
+
+  /* Return success */
+  return TRUE;
+}
+
+SIZE_T
+NTAPI
+VirtualQuery(
+  IN LPCVOID lpAddress,
+  OUT PMEMORY_BASIC_INFORMATION lpBuffer,
+  IN SIZE_T dwLength
+  )
+{
+  /* Call the extended API */
+  return VirtualQueryEx(NtCurrentProcess(),
+                        lpAddress,
+                        lpBuffer,
+                        dwLength);
+}
+
+SIZE_T
+NTAPI
+VirtualQueryEx(
+  IN HANDLE hProcess,
+  IN LPCVOID lpAddress,
+  OUT PMEMORY_BASIC_INFORMATION lpBuffer,
+  IN SIZE_T dwLength
+  )
+{
+  NTSTATUS Status;
+  SIZE_T ResultLength;
+
+  /* Query basic information */
+  Status = NtQueryVirtualMemory(hProcess,
+                                (LPVOID)lpAddress,
+                                MemoryBasicInformation,
+                                lpBuffer,
+                                dwLength,
+                                &ResultLength);
+  if (!NT_SUCCESS(Status))
+  {
+    /* We failed */
+    BaseSetLastNTError(Status);
+    return 0;
+  }
+
+  /* Return the length returned */
+  return ResultLength;
+}
+
+BOOL
+NTAPI
+ReadProcessMemory(
+  IN HANDLE hProcess,
+  IN LPCVOID lpBaseAddress,
+  IN LPVOID lpBuffer,
+  IN SIZE_T nSize,
+  OUT SIZE_T* lpNumberOfBytesRead
+  )
+{
+  NTSTATUS Status;
+
+  /* Do the read */
+  Status = NtReadVirtualMemory(hProcess,
+                               (PVOID)lpBaseAddress,
+                               lpBuffer,
+                               nSize,
+                               &nSize);
+
+  /* In user-mode, this parameter is optional */
+  if (lpNumberOfBytesRead) *lpNumberOfBytesRead = nSize;
+  if (!NT_SUCCESS(Status))
+  {
+    /* We failed */
+    BaseSetLastNTError(Status);
+    return FALSE;
+  }
+
+  /* Return success */
+  return TRUE;
+}
+
+BOOL
+WINAPI
+FlushInstructionCache(
+  IN HANDLE hProcess,
+  IN LPCVOID lpBaseAddress,
+  IN SIZE_T nSize
+  )
+{
+  NTSTATUS Status;
+
+  /* Call the native function */
+  Status = NtFlushInstructionCache(hProcess, (PVOID)lpBaseAddress, nSize);
+  if (!NT_SUCCESS(Status))
+  {
+    /* Handle failure case */
+    BaseSetLastNTError(Status);
+    return FALSE;
+  }
+
+  /* All good */
+  return TRUE;
+}
+
+DWORD
+WINAPI
+SuspendThread(
+  IN HANDLE hThread
+  )
+{
+  ULONG PreviousSuspendCount;
+  NTSTATUS Status;
+
+  Status = NtSuspendThread(hThread, &PreviousSuspendCount);
+  if (!NT_SUCCESS(Status))
+  {
+    BaseSetLastNTError(Status);
+    return -1;
+  }
+
+  return PreviousSuspendCount;
+}
+
+DWORD
+WINAPI
+ResumeThread(
+  IN HANDLE hThread
+  )
+{
+  ULONG PreviousResumeCount;
+  NTSTATUS Status;
+
+  Status = NtResumeThread(hThread, &PreviousResumeCount);
+  if (!NT_SUCCESS(Status))
+  {
+    BaseSetLastNTError(Status);
+    return -1;
+  }
+
+  return PreviousResumeCount;
+}
+
+BOOL
+WINAPI
+GetThreadContext(
+  IN HANDLE hThread,
+  OUT LPCONTEXT lpContext
+  )
+{
+  NTSTATUS Status;
+
+  Status = NtGetContextThread(hThread, lpContext);
+  if (!NT_SUCCESS(Status))
+  {
+    BaseSetLastNTError(Status);
+    return FALSE;
+  }
+
+  return TRUE;
+}
+
+BOOL
+WINAPI
+SetThreadContext(
+  IN HANDLE hThread,
+  IN CONST CONTEXT *lpContext
+  )
+{
+  NTSTATUS Status;
+
+  Status = NtSetContextThread(hThread, (PCONTEXT)lpContext);
+  if (!NT_SUCCESS(Status))
+  {
+    BaseSetLastNTError(Status);
+    return FALSE;
+  }
+
+  return TRUE;
+}
+
+#ifdef __cplusplus
+}
+#endif

DetoursNT/DetoursNT.h

@@ -0,0 +1,348 @@
+#pragma once
+
+#define _ARM_WINAPI_PARTITION_DESKTOP_SDK_AVAILABLE 1
+#include <windows.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#pragma region CRT
+
+extern IMAGE_DOS_HEADER __ImageBase;
+
+#pragma intrinsic(strlen)
+
+void* __cdecl
+memset(
+  void* dest,
+  int ch,
+  size_t count
+  );
+
+void* __cdecl
+memcpy(
+  void* dest,
+  const void* src,
+  size_t count
+  );
+
+// void* __cdecl
+// malloc(
+//   size_t size
+//   );
+//
+// void* __cdecl
+// calloc(
+//   size_t count,
+//   size_t size
+//   );
+//
+// void* __cdecl
+// realloc(
+//   void* ptr,
+//   size_t new_size
+//   );
+//
+// void __cdecl
+// free(
+//   void* ptr
+//   );
+
+#pragma endregion
+
+#pragma region Detours/module.cpp
+
+ULONG WINAPI DetourGetModuleSize(_In_opt_ HMODULE hModule);
+
+#pragma endregion
+
+#pragma region NTDLL.DLL
+
+#define NtCurrentProcess()        ((HANDLE)(LONG_PTR)-1)
+#define ZwCurrentProcess()        NtCurrentProcess()
+#define NtCurrentThread()         ((HANDLE)(LONG_PTR)-2)
+#define ZwCurrentThread()         NtCurrentThread()
+
+typedef enum _MEMORY_INFORMATION_CLASS
+{
+  MemoryBasicInformation,
+  MemoryWorkingSetList,
+  MemorySectionName,
+  MemoryBasicVlmInformation,
+  MemoryWorkingSetExList
+} MEMORY_INFORMATION_CLASS;
+
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+NtAllocateVirtualMemory(
+  _In_ HANDLE ProcessHandle,
+  _Inout_ _At_(*BaseAddress, _Readable_bytes_(*RegionSize) _Writable_bytes_(*RegionSize) _Post_readable_byte_size_(*RegionSize)) PVOID *BaseAddress,
+  _In_ ULONG_PTR ZeroBits,
+  _Inout_ PSIZE_T RegionSize,
+  _In_ ULONG AllocationType,
+  _In_ ULONG Protect
+  );
+
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+NtFreeVirtualMemory(
+  _In_ HANDLE ProcessHandle,
+  _Inout_ PVOID *BaseAddress,
+  _Inout_ PSIZE_T RegionSize,
+  _In_ ULONG FreeType
+  );
+
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+NtProtectVirtualMemory(
+  _In_ HANDLE ProcessHandle,
+  _Inout_ PVOID *BaseAddress,
+  _Inout_ PSIZE_T RegionSize,
+  _In_ ULONG NewProtect,
+  _Out_ PULONG OldProtect
+  );
+
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+NtQueryVirtualMemory(
+  _In_ HANDLE ProcessHandle,
+  _In_opt_ PVOID BaseAddress,
+  _In_ MEMORY_INFORMATION_CLASS MemoryInformationClass,
+  _Out_writes_bytes_(MemoryInformationLength) PVOID MemoryInformation,
+  _In_ SIZE_T MemoryInformationLength,
+  _Out_opt_ PSIZE_T ReturnLength
+  );
+
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+NtReadVirtualMemory(
+  _In_ HANDLE ProcessHandle,
+  _In_opt_ PVOID BaseAddress,
+  _Out_writes_bytes_(BufferSize) PVOID Buffer,
+  _In_ SIZE_T BufferSize,
+  _Out_opt_ PSIZE_T NumberOfBytesRead
+  );
+
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+NtWriteVirtualMemory(
+  _In_ HANDLE ProcessHandle,
+  _In_opt_ PVOID BaseAddress,
+  _In_reads_bytes_(BufferSize) PVOID Buffer,
+  _In_ SIZE_T BufferSize,
+  _Out_opt_ PSIZE_T NumberOfBytesWritten
+  );
+
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+NtFlushInstructionCache(
+  _In_ HANDLE ProcessHandle,
+  _In_opt_ PVOID BaseAddress,
+  _In_ SIZE_T Length
+  );
+
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+NtSuspendThread(
+  _In_ HANDLE ThreadHandle,
+  _Out_opt_ PULONG PreviousSuspendCount
+  );
+
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+NtResumeThread(
+  _In_ HANDLE ThreadHandle,
+  _Out_opt_ PULONG PreviousSuspendCount
+  );
+
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+NtGetContextThread(
+  _In_ HANDLE ThreadHandle,
+  _Inout_ PCONTEXT ThreadContext
+  );
+
+NTSYSCALLAPI
+NTSTATUS
+NTAPI
+NtSetContextThread(
+  _In_ HANDLE ThreadHandle,
+  _In_ PCONTEXT ThreadContext
+  );
+
+#pragma endregion
+
+#pragma region KERNEL32.DLL
+
+#define GetLastError                Mock_GetLastError
+#define SetLastError                Mock_SetLastError
+
+#define GetCurrentProcess()         NtCurrentProcess()
+#define GetCurrentThread()          NtCurrentThread()
+#define GetCurrentThreadId          Mock_GetCurrentThreadId
+
+#define VirtualAlloc                Mock_VirtualAlloc
+#define VirtualAllocEx              Mock_VirtualAllocEx
+#define VirtualFree                 Mock_VirtualFree
+#define VirtualFreeEx               Mock_VirtualFreeEx
+#define VirtualProtect              Mock_VirtualProtect
+#define VirtualProtectEx            Mock_VirtualProtectEx
+#define VirtualQuery                Mock_VirtualQuery
+#define VirtualQueryEx              Mock_VirtualQueryEx
+#define ReadProcessMemory           Mock_ReadProcessMemory
+#define WriteProcessMemory          Mock_WriteProcessMemory
+#define FlushInstructionCache       Mock_FlushInstructionCache
+#define SuspendThread               Mock_SuspendThread
+#define ResumeThread                Mock_ResumeThread
+#define GetThreadContext            Mock_GetThreadContext
+#define SetThreadContext            Mock_SetThreadContext
+#define DebugBreak                  __debugbreak
+
+DWORD
+WINAPI
+GetLastError(
+  VOID
+  );
+
+VOID
+WINAPI
+SetLastError(
+  IN DWORD dwErrCode
+  );
+
+DWORD
+WINAPI
+GetCurrentThreadId(
+  VOID
+  );
+
+LPVOID
+NTAPI
+VirtualAlloc(
+  IN LPVOID lpAddress,
+  IN SIZE_T dwSize,
+  IN DWORD flAllocationType,
+  IN DWORD flProtect
+  );
+
+LPVOID
+NTAPI
+VirtualAllocEx(
+  IN HANDLE hProcess,
+  IN LPVOID lpAddress,
+  IN SIZE_T dwSize,
+  IN DWORD flAllocationType,
+  IN DWORD flProtect
+  );
+
+BOOL
+NTAPI
+VirtualFree(
+  IN LPVOID lpAddress,
+  IN SIZE_T dwSize,
+  IN DWORD dwFreeType
+  );
+
+BOOL
+NTAPI
+VirtualFreeEx(
+  IN HANDLE hProcess,
+  IN LPVOID lpAddress,
+  IN SIZE_T dwSize,
+  IN DWORD dwFreeType
+  );
+
+BOOL
+NTAPI
+VirtualProtect(
+  IN LPVOID lpAddress,
+  IN SIZE_T dwSize,
+  IN DWORD flNewProtect,
+  OUT PDWORD lpflOldProtect
+  );
+
+BOOL
+NTAPI
+VirtualProtectEx(
+  IN HANDLE hProcess,
+  IN LPVOID lpAddress,
+  IN SIZE_T dwSize,
+  IN DWORD flNewProtect,
+  OUT PDWORD lpflOldProtect
+  );
+
+SIZE_T
+NTAPI
+VirtualQuery(
+  IN LPCVOID lpAddress,
+  OUT PMEMORY_BASIC_INFORMATION lpBuffer,
+  IN SIZE_T dwLength
+  );
+
+SIZE_T
+NTAPI
+VirtualQueryEx(
+  IN HANDLE hProcess,
+  IN LPCVOID lpAddress,
+  OUT PMEMORY_BASIC_INFORMATION lpBuffer,
+  IN SIZE_T dwLength
+  );
+
+BOOL
+NTAPI
+ReadProcessMemory(
+  IN HANDLE hProcess,
+  IN LPCVOID lpBaseAddress,
+  IN LPVOID lpBuffer,
+  IN SIZE_T nSize,
+  OUT SIZE_T* lpNumberOfBytesRead
+  );
+
+BOOL
+WINAPI
+FlushInstructionCache(
+  IN HANDLE hProcess,
+  IN LPCVOID lpBaseAddress,
+  IN SIZE_T nSize
+  );
+
+DWORD
+WINAPI
+SuspendThread(
+  IN HANDLE hThread
+  );
+
+DWORD
+WINAPI
+ResumeThread(
+  IN HANDLE hThread
+  );
+
+BOOL
+WINAPI
+GetThreadContext(
+  IN HANDLE hThread,
+  OUT LPCONTEXT lpContext
+  );
+
+BOOL
+WINAPI
+SetThreadContext(
+  IN HANDLE hThread,
+  IN CONST CONTEXT *lpContext
+  );
+
+#ifdef __cplusplus
+}
+#endif

DetoursNT/DetoursNT.vcxproj

@@ -0,0 +1,200 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="..\Detours\src\detours.h" />
+    <ClInclude Include="..\Detours\src\detver.h" />
+    <ClInclude Include="DetoursNT.h" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="..\Detours\src\detours.cpp" />
+    <ClCompile Include="..\Detours\src\disasm.cpp" />
+    <ClCompile Include="..\Detours\src\disolarm.cpp" />
+    <ClCompile Include="..\Detours\src\disolarm64.cpp" />
+    <ClCompile Include="..\Detours\src\disolia64.cpp" />
+    <ClCompile Include="..\Detours\src\disolx64.cpp" />
+    <ClCompile Include="..\Detours\src\disolx86.cpp" />
+    <ClCompile Include="DetoursNT.cpp" />
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <ProjectGuid>{C78B9003-FC49-4BBF-8F29-52FAD48BB58A}</ProjectGuid>
+    <Keyword>Win32Proj</Keyword>
+    <RootNamespace>DetoursNT</RootNamespace>
+    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="Shared">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <LinkIncremental>true</LinkIncremental>
+    <OutDir>$(SolutionDir)Bin\$(PlatformShortName)\$(Configuration)\</OutDir>
+    <IntDir>$(SolutionDir)Bin\Obj\$(PlatformShortName)\$(Configuration)\$(ProjectName)\</IntDir>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <LinkIncremental>true</LinkIncremental>
+    <OutDir>$(SolutionDir)Bin\$(PlatformShortName)\$(Configuration)\</OutDir>
+    <IntDir>$(SolutionDir)Bin\Obj\$(PlatformShortName)\$(Configuration)\$(ProjectName)\</IntDir>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <LinkIncremental>false</LinkIncremental>
+    <OutDir>$(SolutionDir)Bin\$(PlatformShortName)\$(Configuration)\</OutDir>
+    <IntDir>$(SolutionDir)Bin\Obj\$(PlatformShortName)\$(Configuration)\$(ProjectName)\</IntDir>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <LinkIncremental>false</LinkIncremental>
+    <OutDir>$(SolutionDir)Bin\$(PlatformShortName)\$(Configuration)\</OutDir>
+    <IntDir>$(SolutionDir)Bin\Obj\$(PlatformShortName)\$(Configuration)\$(ProjectName)\</IntDir>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <PrecompiledHeader>
+      </PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
+      <ExceptionHandling>false</ExceptionHandling>
+      <BasicRuntimeChecks>Default</BasicRuntimeChecks>
+      <BufferSecurityCheck>false</BufferSecurityCheck>
+      <ForcedIncludeFiles>$(ProjectDir)DetoursNT.h</ForcedIncludeFiles>
+      <SupportJustMyCode>false</SupportJustMyCode>
+      <MultiProcessorCompilation>true</MultiProcessorCompilation>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <AdditionalDependencies>ntdll.lib</AdditionalDependencies>
+      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <PrecompiledHeader>
+      </PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
+      <ExceptionHandling>false</ExceptionHandling>
+      <BasicRuntimeChecks>Default</BasicRuntimeChecks>
+      <BufferSecurityCheck>false</BufferSecurityCheck>
+      <ForcedIncludeFiles>$(ProjectDir)DetoursNT.h</ForcedIncludeFiles>
+      <SupportJustMyCode>false</SupportJustMyCode>
+      <MultiProcessorCompilation>true</MultiProcessorCompilation>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <AdditionalDependencies>ntdll.lib</AdditionalDependencies>
+      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <PrecompiledHeader>
+      </PrecompiledHeader>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+      <ExceptionHandling>false</ExceptionHandling>
+      <ForcedIncludeFiles>$(ProjectDir)DetoursNT.h</ForcedIncludeFiles>
+      <WholeProgramOptimization>false</WholeProgramOptimization>
+      <BufferSecurityCheck>false</BufferSecurityCheck>
+      <MultiProcessorCompilation>true</MultiProcessorCompilation>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
+      <AdditionalDependencies>ntdll.lib</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <PrecompiledHeader>
+      </PrecompiledHeader>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+      <ExceptionHandling>false</ExceptionHandling>
+      <ForcedIncludeFiles>$(ProjectDir)DetoursNT.h</ForcedIncludeFiles>
+      <WholeProgramOptimization>false</WholeProgramOptimization>
+      <BufferSecurityCheck>false</BufferSecurityCheck>
+      <MultiProcessorCompilation>true</MultiProcessorCompilation>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <AdditionalDependencies>ntdll.lib</AdditionalDependencies>
+      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
+    </Link>
+  </ItemDefinitionGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>

DetoursNT/DetoursNT.vcxproj.filters

@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="Source Files">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="Header Files">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hh;hpp;hxx;hm;inl;inc;xsd</Extensions>
+    </Filter>
+    <Filter Include="Resource Files">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+    <Filter Include="Header Files\Detours">
+      <UniqueIdentifier>{188cea67-e1ec-45f2-9f5f-4d5305424006}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="Source Files\Detours">
+      <UniqueIdentifier>{9ceaf48e-9556-48de-8843-db3da4464cbe}</UniqueIdentifier>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="..\Detours\src\detours.h">
+      <Filter>Header Files\Detours</Filter>
+    </ClInclude>
+    <ClInclude Include="..\Detours\src\detver.h">
+      <Filter>Header Files\Detours</Filter>
+    </ClInclude>
+    <ClInclude Include="DetoursNT.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="..\Detours\src\detours.cpp">
+      <Filter>Source Files\Detours</Filter>
+    </ClCompile>
+    <ClCompile Include="..\Detours\src\disasm.cpp">
+      <Filter>Source Files\Detours</Filter>
+    </ClCompile>
+    <ClCompile Include="..\Detours\src\disolarm.cpp">
+      <Filter>Source Files\Detours</Filter>
+    </ClCompile>
+    <ClCompile Include="..\Detours\src\disolarm64.cpp">
+      <Filter>Source Files\Detours</Filter>
+    </ClCompile>
+    <ClCompile Include="..\Detours\src\disolia64.cpp">
+      <Filter>Source Files\Detours</Filter>
+    </ClCompile>
+    <ClCompile Include="..\Detours\src\disolx64.cpp">
+      <Filter>Source Files\Detours</Filter>
+    </ClCompile>
+    <ClCompile Include="..\Detours\src\disolx86.cpp">
+      <Filter>Source Files\Detours</Filter>
+    </ClCompile>
+    <ClCompile Include="DetoursNT.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+  </ItemGroup>
+</Project>

DetoursNT/DetoursNT.vcxproj.user

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <PropertyGroup />
+</Project>

LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2018 Petr Benes
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,70 @@
+# DetoursNT
+
+DetoursNT is a simple project with one goal - make Detours dependent only on `NTDLL.DLL` without any modifications of
+the original code.
+
+### Why?
+
+- Because this way you can hook native processes.
+- Because this way you can load your hooking library **right after** load of `NTDLL.DLL`
+  - This can be achieved in many ways - for example using Windows Driver via so-called APC injection.
+    You can look at my project [KeInject][keinject] to get an idea about how is this done.
+
+### How?
+
+This repository has attached original git repository of Detours from Microsoft as a submodule.
+Therefore, the original code hasn't been touched in any way.
+
+NTDLL-only dependency been achieved by creating a C header file [DetoursNT.h](DetoursNT/DetoursNT.h) which has
+been force-included (`/FI` switch of MSVC) into every compilation unit of Detours. This header
+mocks functions of `KERNEL32.DLL` to custom implementation defined in [DetoursNT.cpp](DetoursNT/DetoursNT.cpp).
+
+I'd like to thank authors of following projects:
+- [ReactOS][reactos] - used for implementation of `KERNEL32.DLL` functions
+- [ProcessHacker][processhacker] - used for prototypes of `NTDLL.DLL` functions
+
+### Compilation
+
+Because original Detours source code is attached as a git submodule, you must not forget to fetch it:
+
+`git clone --recurse-submodules https://github.com/wbenny/DetoursNT`
+
+After that, compile **DetoursNT** using Visual Studio 2017. Solution file is included. No other dependencies are required.
+
+### Usage
+
+After you hit `F7` in Visual Studio and have everyting compiled, you can check that `SampleHookDLL.dll`
+indeed depends only on `NTDLL.DLL`:
+
+![Dependency Walker](Images/depends.png)
+
+This hooking DLL only hooks `NtTestAlert` function for demonstrative purposes. In this repository there is also
+`Sample` project. It's only purpose is to call `LoadLibrary(TEXT("SampleHookDLL.dll"))`, `NtTestAlert()` and
+`FreeLibrary()` to show you that the hook is working.
+
+![Sample](Images/sample.png)
+
+### Remarks
+
+- This implementation intentionally crashes on SEH exceptions which occur inside of Detours. This is because SEH
+  handlers are usually located in CRT (which is ommited here).
+- Only x86 and x64 is currently supported.
+
+
+### License
+
+This software is open-source under the MIT license. See the LICENSE.txt file in this repository.
+
+[Detours][detours] is licensed under MIT license (a copy of the license is included in separate git submodule)
+
+If you find this project interesting, you can buy me a coffee
+
+```
+  BTC 12hwTTPYDbkVqsfpGjrsVa7WpShvQn24ro
+  LTC LLDVqnBEMS8Tv7ZF1otcy56HDhkXVVFJDH
+```
+
+  [detours]: <https://github.com/Microsoft/Detours>
+  [keinject]: <https://github.com/wbenny/keinject>
+  [reactos]: <https://www.reactos.org/>
+  [processhacker]: <https://github.com/processhacker/processhacker/tree/master/phnt/include>

Sample/Sample.vcxproj

@@ -0,0 +1,171 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <VCProjectVersion>15.0</VCProjectVersion>
+    <ProjectGuid>{113B23FE-32D7-4D79-8A74-119BC11C25E2}</ProjectGuid>
+    <Keyword>Win32Proj</Keyword>
+    <RootNamespace>Sample</RootNamespace>
+    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="Shared">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <LinkIncremental>true</LinkIncremental>
+    <OutDir>$(SolutionDir)Bin\$(PlatformShortName)\$(Configuration)\</OutDir>
+    <IntDir>$(SolutionDir)Bin\Obj\$(PlatformShortName)\$(Configuration)\$(ProjectName)\</IntDir>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <LinkIncremental>true</LinkIncremental>
+    <OutDir>$(SolutionDir)Bin\$(PlatformShortName)\$(Configuration)\</OutDir>
+    <IntDir>$(SolutionDir)Bin\Obj\$(PlatformShortName)\$(Configuration)\$(ProjectName)\</IntDir>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <LinkIncremental>false</LinkIncremental>
+    <OutDir>$(SolutionDir)Bin\$(PlatformShortName)\$(Configuration)\</OutDir>
+    <IntDir>$(SolutionDir)Bin\Obj\$(PlatformShortName)\$(Configuration)\$(ProjectName)\</IntDir>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <LinkIncremental>false</LinkIncremental>
+    <OutDir>$(SolutionDir)Bin\$(PlatformShortName)\$(Configuration)\</OutDir>
+    <IntDir>$(SolutionDir)Bin\Obj\$(PlatformShortName)\$(Configuration)\$(ProjectName)\</IntDir>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeaderFile>
+      </PrecompiledHeaderFile>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <AdditionalDependencies>ntdll.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeaderFile>
+      </PrecompiledHeaderFile>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <AdditionalDependencies>ntdll.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeaderFile>
+      </PrecompiledHeaderFile>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <AdditionalDependencies>ntdll.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeaderFile>
+      </PrecompiledHeaderFile>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <AdditionalDependencies>ntdll.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="main.cpp" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>

Sample/Sample.vcxproj.filters

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="Source Files">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="Header Files">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hh;hpp;hxx;hm;inl;inc;ipp;xsd</Extensions>
+    </Filter>
+    <Filter Include="Resource Files">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="main.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+  </ItemGroup>
+</Project>

Sample/Sample.vcxproj.user

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <PropertyGroup />
+</Project>

SampleHookDLL/SampleHookDLL.vcxproj

@@ -0,0 +1,197 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="main.cpp" />
+  </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\DetoursNT\DetoursNT.vcxproj">
+      <Project>{c78b9003-fc49-4bbf-8f29-52fad48bb58a}</Project>
+    </ProjectReference>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <ProjectGuid>{6266D1B7-DD83-4A79-B7F3-DA8099BBAB1B}</ProjectGuid>
+    <Keyword>Win32Proj</Keyword>
+    <RootNamespace>SampleHookDLL</RootNamespace>
+    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="Shared">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <LinkIncremental>true</LinkIncremental>
+    <OutDir>$(SolutionDir)Bin\$(PlatformShortName)\$(Configuration)\</OutDir>
+    <IntDir>$(SolutionDir)Bin\Obj\$(PlatformShortName)\$(Configuration)\$(ProjectName)\</IntDir>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <LinkIncremental>true</LinkIncremental>
+    <OutDir>$(SolutionDir)Bin\$(PlatformShortName)\$(Configuration)\</OutDir>
+    <IntDir>$(SolutionDir)Bin\Obj\$(PlatformShortName)\$(Configuration)\$(ProjectName)\</IntDir>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <LinkIncremental>false</LinkIncremental>
+    <OutDir>$(SolutionDir)Bin\$(PlatformShortName)\$(Configuration)\</OutDir>
+    <IntDir>$(SolutionDir)Bin\Obj\$(PlatformShortName)\$(Configuration)\$(ProjectName)\</IntDir>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <LinkIncremental>false</LinkIncremental>
+    <OutDir>$(SolutionDir)Bin\$(PlatformShortName)\$(Configuration)\</OutDir>
+    <IntDir>$(SolutionDir)Bin\Obj\$(PlatformShortName)\$(Configuration)\$(ProjectName)\</IntDir>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <PrecompiledHeader>
+      </PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
+      <ExceptionHandling>false</ExceptionHandling>
+      <BasicRuntimeChecks>Default</BasicRuntimeChecks>
+      <BufferSecurityCheck>false</BufferSecurityCheck>
+      <SupportJustMyCode>false</SupportJustMyCode>
+      <MultiProcessorCompilation>true</MultiProcessorCompilation>
+      <AdditionalIncludeDirectories>$(SolutionDir)Detours\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EntryPointSymbol>NtDllMain</EntryPointSymbol>
+      <AdditionalDependencies>ntdll.lib</AdditionalDependencies>
+      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <PrecompiledHeader>
+      </PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
+      <ExceptionHandling>false</ExceptionHandling>
+      <BasicRuntimeChecks>Default</BasicRuntimeChecks>
+      <BufferSecurityCheck>false</BufferSecurityCheck>
+      <SupportJustMyCode>false</SupportJustMyCode>
+      <MultiProcessorCompilation>true</MultiProcessorCompilation>
+      <AdditionalIncludeDirectories>$(SolutionDir)Detours\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EntryPointSymbol>NtDllMain</EntryPointSymbol>
+      <AdditionalDependencies>ntdll.lib</AdditionalDependencies>
+      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <PrecompiledHeader>
+      </PrecompiledHeader>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+      <ExceptionHandling>false</ExceptionHandling>
+      <WholeProgramOptimization>false</WholeProgramOptimization>
+      <BufferSecurityCheck>false</BufferSecurityCheck>
+      <MultiProcessorCompilation>true</MultiProcessorCompilation>
+      <AdditionalIncludeDirectories>$(SolutionDir)Detours\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EntryPointSymbol>NtDllMain</EntryPointSymbol>
+      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
+      <AdditionalDependencies>ntdll.lib</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <PrecompiledHeader>
+      </PrecompiledHeader>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+      <ExceptionHandling>false</ExceptionHandling>
+      <WholeProgramOptimization>false</WholeProgramOptimization>
+      <BufferSecurityCheck>false</BufferSecurityCheck>
+      <MultiProcessorCompilation>true</MultiProcessorCompilation>
+      <AdditionalIncludeDirectories>$(SolutionDir)Detours\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ClCompile>
+    <Link>
+      <SubSystem>Windows</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EntryPointSymbol>NtDllMain</EntryPointSymbol>
+      <AdditionalDependencies>ntdll.lib</AdditionalDependencies>
+      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
+    </Link>
+  </ItemDefinitionGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>

SampleHookDLL/SampleHookDLL.vcxproj.filters

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="Source Files">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="Header Files">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hh;hpp;hxx;hm;inl;inc;xsd</Extensions>
+    </Filter>
+    <Filter Include="Resource Files">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="main.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+  </ItemGroup>
+</Project>

SampleHookDLL/SampleHookDLL.vcxproj.user

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <PropertyGroup />
+</Project>

SampleHookDLL/main.cpp

@@ -0,0 +1,71 @@
+#include <windows.h>
+#include <detours.h>
+
+#define NtCurrentProcess()        ((HANDLE)(LONG_PTR)-1)
+#define ZwCurrentProcess()        NtCurrentProcess()
+#define NtCurrentThread()         ((HANDLE)(LONG_PTR)-2)
+#define ZwCurrentThread()         NtCurrentThread()
+
+typedef NTSTATUS (NTAPI * fnNtTestAlert)(
+  VOID
+  );
+
+static fnNtTestAlert OrigNtTestAlert;
+
+EXTERN_C
+NTSYSAPI
+NTSTATUS
+NTAPI
+NtTestAlert(
+  VOID
+  );
+
+EXTERN_C
+NTSTATUS
+NTAPI
+HookNtTestAlert(
+  VOID
+  )
+{
+  return 0x1337;
+}
+
+EXTERN_C
+BOOL
+WINAPI
+NtDllMain(
+  _In_ HINSTANCE hModule,
+  _In_ DWORD dwReason,
+  _In_ LPVOID lpvReserved
+  )
+{
+  switch (dwReason)
+  {
+    case DLL_PROCESS_ATTACH:
+      OrigNtTestAlert = NtTestAlert;
+
+      DetourTransactionBegin();
+      DetourUpdateThread(NtCurrentThread());
+      DetourAttach((PVOID*)&OrigNtTestAlert, HookNtTestAlert);
+      DetourTransactionCommit();
+      break;
+
+    case DLL_PROCESS_DETACH:
+      DetourTransactionBegin();
+      DetourUpdateThread(NtCurrentThread());
+      DetourDetach((PVOID*)&OrigNtTestAlert, HookNtTestAlert);
+      DetourTransactionCommit();
+      break;
+
+    case DLL_THREAD_ATTACH:
+
+      break;
+
+    case DLL_THREAD_DETACH:
+
+      break;
+  }
+
+  return TRUE;
+}
+