Deviare-InProc

Great! We have been working on Windows Process (and COM) injection since 2003 [1][2][3]. I need to talk with the current development team about reviewing it with the EDR-Preloading technique. We have a driver also that suspends a new process before hooking it, we also hook existing processes. Business-wise our work on this went down once Microsoft Detours was made FOSS even when our products has other capabilities. A good old thread is here [4]. [1] https://github.com/nektra/Deviare2 [2] https://github.com/nektra/Deviare-InProc [3] https://github.com/nektra/RemoteBridge [4] https://www.reddit.com/r/programming/comments/22crn0/gpl_alt...

Even not being Microsoft, our hooking engines are also extremely robust and has additional features (higher level interface to hook in any language and hooking COMs and .NET): https://github.com/nektra/Deviare2 https://github.com/nektra/Deviare-InProc, and https://github.com/nektra/RemoteBridge They are being used in well known security companies and intelligence organizations.

Shameless plug: my company released a free Windows tracing tool that can intercept a lot of user level Win32 calls. It is available here: http://www.nektra.com/products/spystudio-api-monitor/ you can even build your own tool with the folowing open source instrumentation frameworks: https://github.com/nektra/Deviare-InProc/ and https://github.com/nektra/Deviare2

Shameless plug: if you are looking for something similar to DTrace but for Windows that can be also used in Python or any other COM capable programming language... you can take a look at our Deviare Hooking Engine: https://github.com/nektra/Deviare2 Additionally, we have other open source instrumentation engines like https://github.com/nektra/Deviare-InProc (better and more secure than Detours, check [1]), RemoteBridge: https://github.com/nektra/RemoteBridge. SpyStudio will also be open sourced very soon: http://www.nektra.com/products/spystudio-api-monitor/ [1] https://www.blackhat.com/docs/us-16/materials/us-16-Yavo-Cap... and https://www.blackhat.com/docs/us-16/materials/us-16-Yavo-Cap...

I am never tired of this shameless plug: our state of the art open source instrumentation engines for Microsoft Windows where you can hook applications without even knowing about the complexities of hooking. The most programmer friendly is https://github.com/nektra/Deviare2 while the Microsoft Detours competitor is: https://github.com/nektra/Deviare-InProc It has an embedded disassembler to smartly hook functions even if they have a jmp in the prologue.

Shameless plug but my company is almost wholly oriented to binary intrumentation! In our Deviare Hooking Engine/Deviare In Process [gihub-1] and RemoteBridge [github-2], we have a disassembler in place to hook Win32/COM/C++ vtables, so the hooking process is smarter if there are changes in the prologue. You can obviously take a look at the source code and learn a lot from it since it is state of art and perfectly competing with Microsoft Detours [3]. For an old comparison with Microsoft Detours you can check [4]. For anyone else looking for an extremely easy to use and higher level API, Deviare Hooking Engine makes extremely easy to hook and handle functions parameters and return value. Simple like this: [snippet] notepadPID = LaunchNotepadAndGetPid(); //in first place, hook DllGetClassObject of the target dll/ocx

My two cents: if you need to instrument native Windows applications, including Win32 and COM, my company develops three mature GPLv3 libs: 1/ Deviare In-Proc (like Microsoft Detours): https://github.com/nektra/Deviare-InProc 2/ Deviare Hooking Engine (even novices can instrument apps): https://github.com/nektra/Deviare2 3/ RemoteBridge (access internal COM and Java apps) https://github.com/nektra/RemoteBridge All these libs include examples and there are additional use cases in our blog http://blog.nektra.com

If you are interested in rapid sandboxing for Windows (yes, with support for W10 and x86/x64), you can take a look at my company's open source libs: - https://github.com/nektra/deviare2 - https://github.com/nektra/Deviare-InProc/ The first one is extremely easy to use and does a lot of work behind the scenes. For example, Symantec use it for running legacy applications such as Internet Explorer 6 in Windows 7. They are not focused on the kind of security isolation of Vx32 but they work in low privilege Windows processes.

Better to link directly to the library: https://github.com/nektra/Deviare-InProc/blob/master/README....