Channel 9 Forums - Coffeehouse - Detouring Win32 Function Calls in PowerShell http://mschnlnine.vo.llnwd.net/d1/Dev/App_Themes/C9/images/feedimage.png Channel 9 Forums - Coffeehouse - Detouring Win32 Function Calls in PowerShell http://channel9.msdn.com/Forums Channel 9 keeps you up to date with the latest news and behind the scenes info from Microsoft that developers love to keep up with. From LINQ to SilverLight – Watch videos and hear about all the cool technologies coming and the people behind them. http://channel9.msdn.com/Forums en Tue, 18 Jun 2013 04:36:28 GMT Tue, 18 Jun 2013 04:36:28 GMT Rev9 6 -6 -1 Coffeehouse - Detouring Win32 Function Calls in PowerShell I came across this earlier today. I didn't realize that hooking Win32 calls could be so simple.

-Josh

]]> http://channel9.msdn.com/Forums/Coffeehouse/Detouring-Win32-Function-Calls-in-PowerShell/1eb045cde259415cb47ea11a012288bc#1eb045cde259415cb47ea11a012288bc Sat, 01 Dec 2012 17:37:48 GMT http://channel9.msdn.com/Forums/Coffeehouse/Detouring-Win32-Function-Calls-in-PowerShell/1eb045cde259415cb47ea11a012288bc#1eb045cde259415cb47ea11a012288bc Joshua Ross 6 http://channel9.msdn.com/Niners/Jsoh/Discussions/RSS Coffeehouse - Detouring Win32 Function Calls in PowerShell It's only simple because you're using a library that hides the complexity. Smiley

]]> http://channel9.msdn.com/Forums/Coffeehouse/Detouring-Win32-Function-Calls-in-PowerShell/179c0a81f14a4cd8a0e3a11b0049878d#179c0a81f14a4cd8a0e3a11b0049878d Sun, 02 Dec 2012 04:27:42 GMT http://channel9.msdn.com/Forums/Coffeehouse/Detouring-Win32-Function-Calls-in-PowerShell/179c0a81f14a4cd8a0e3a11b0049878d#179c0a81f14a4cd8a0e3a11b0049878d Sven Groot 6 http://channel9.msdn.com/Niners/Sven Groot/Discussions/RSS Coffeehouse - Detouring Win32 Function Calls in PowerShell It's worth pointing out that detouring functions is entirely unsupported in Win32. If you do it, Watson will automatically discard crash dumps that patch Microsoft libraries (because it can no longer tell if you crashed because you screwed up the internal Microsoft library state) and they won't make any attempt to ensure that you program continues to work past any given Windows Update or change of the OS.

As soon as you begin detouring functions, you live entirely on your own.

]]> http://channel9.msdn.com/Forums/Coffeehouse/Detouring-Win32-Function-Calls-in-PowerShell/4348b78b949a4170a067a11b00eff0b8#4348b78b949a4170a067a11b00eff0b8 Sun, 02 Dec 2012 14:33:35 GMT http://channel9.msdn.com/Forums/Coffeehouse/Detouring-Win32-Function-Calls-in-PowerShell/4348b78b949a4170a067a11b00eff0b8#4348b78b949a4170a067a11b00eff0b8 evildictaitor 6 http://channel9.msdn.com/Niners/evildictaitor/Discussions/RSS Coffeehouse - Detouring Win32 Function Calls in PowerShell I'm not sure why you would want to detour for legitimate reasons. Science? Anyways. I couldn't see someone using this in production, it seem more suited for a test environment.

-Josh

]]> http://channel9.msdn.com/Forums/Coffeehouse/Detouring-Win32-Function-Calls-in-PowerShell/550476bb1437413087ffa11c0005a932#550476bb1437413087ffa11c0005a932 Mon, 03 Dec 2012 00:20:36 GMT http://channel9.msdn.com/Forums/Coffeehouse/Detouring-Win32-Function-Calls-in-PowerShell/550476bb1437413087ffa11c0005a932#550476bb1437413087ffa11c0005a932 Joshua Ross 6 http://channel9.msdn.com/Niners/Jsoh/Discussions/RSS Coffeehouse - Detouring Win32 Function Calls in PowerShell Oh, it gets better.

-Josh

]]> http://channel9.msdn.com/Forums/Coffeehouse/Detouring-Win32-Function-Calls-in-PowerShell/f0ec809643da49bd889fa11d018b223c#f0ec809643da49bd889fa11d018b223c Tue, 04 Dec 2012 23:58:38 GMT http://channel9.msdn.com/Forums/Coffeehouse/Detouring-Win32-Function-Calls-in-PowerShell/f0ec809643da49bd889fa11d018b223c#f0ec809643da49bd889fa11d018b223c Joshua Ross 6 http://channel9.msdn.com/Niners/Jsoh/Discussions/RSS Coffeehouse - Detouring Win32 Function Calls in PowerShell

, JoshRoss wrote

I'm not sure why you would want to detour for legitimate reasons. Science? Anyways. I couldn't see someone using this in production, it seem more suited for a test environment.

-Josh

AppCompat is pretty much the only good reason.

And even then, that's a good reason for Microsoft to do it. Not a good reason for you to do it.

]]> http://channel9.msdn.com/Forums/Coffeehouse/Detouring-Win32-Function-Calls-in-PowerShell/91470408a6a94d459a51a11e00001b52#91470408a6a94d459a51a11e00001b52 Wed, 05 Dec 2012 00:00:23 GMT http://channel9.msdn.com/Forums/Coffeehouse/Detouring-Win32-Function-Calls-in-PowerShell/91470408a6a94d459a51a11e00001b52#91470408a6a94d459a51a11e00001b52 evildictaitor 6 http://channel9.msdn.com/Niners/evildictaitor/Discussions/RSS