Hacker News Reader

Detours rewrites instructions at the start of the detoured function. Why should it know or care whether the instructions it's overwriting happen to be ones written by a previous detour? Why would you need to synchronize?

View on HN

Doesn't the Microsoft implementation work by having nop instruction as the first instruction of the function, which can then be patched to a jump to the patched code, that finally jumps back to the original function past the NOP?

Naive implementation of this scheme doesn't allow stacking.

If you have the standard two-byte backwards jump pointing to a longer jump instruction, you also have another happy case for overriding it (just change the long jump).

Meanwhile, the Microsoft Detours library supports detouring other kinds of instructions at the beginning of a function. It's not exclusively for the 'two byte nop and blank space' thing.

1) Thread A could read the original instructions immediately before thread B replaces them. Thread A’s trampoline would contain the original instructions, not the instructions from thread B, so it would bypass thread B’s hook.

2) Thread A reads original instructions while thread B is replacing them, such that it reads part of an original instruction and part of a replaced instruction. Thread A’s trampoline would have nonsensical instructions.

Reply on news.ycombinator.com