Comments on: The First Rule of Programming: It’s Always Your Fault http://www.mikeandrews.com/2008/03/22/the-first-rule-of-programming-its-always-your-fault/ Fri, 09 Apr 2010 12:01:55 -0700 http://wordpress.org/?v=2.9.2 hourly 1 By: Mike http://www.mikeandrews.com/2008/03/22/the-first-rule-of-programming-its-always-your-fault/comment-page-1/#comment-90 Mike Sun, 23 Mar 2008 03:55:41 +0000 http://www.mikeandrews.com/2008/03/22/the-first-rule-of-programming-its-always-your-fault/#comment-90 Yep - I was one of the first users of it *way* back. A little complicated to use I felt at that time, so the guys at Florida Tech developed their own called HEAT (http://www.cs.fit.edu/~tr/tr2003.html). Pretty much the same thing, but (to me at least) it was a much easier to use API. From that tech a lot of research projects were based. I really like your write up Didier and how you are using it - it was hard back then to find adequate documentation on how DLL hooking and process injection worked, but now it seems there's a wealth of info out there. If anyone wants to see graphically how it's done without reading the HEAT paper or digging into technical docs I put together some "injection 101" images at http://www.mikeandrews.com/projects/signpost/monitoring.php Yep – I was one of the first users of it *way* back. A little complicated to use I felt at that time, so the guys at Florida Tech developed their own called HEAT (http://www.cs.fit.edu/~tr/tr2003.html). Pretty much the same thing, but (to me at least) it was a much easier to use API. From that tech a lot of research projects were based.

I really like your write up Didier and how you are using it – it was hard back then to find adequate documentation on how DLL hooking and process injection worked, but now it seems there’s a wealth of info out there. If anyone wants to see graphically how it’s done without reading the HEAT paper or digging into technical docs I put together some “injection 101″ images at http://www.mikeandrews.com/projects/signpost/monitoring.php

]]> By: Didier Stevens http://www.mikeandrews.com/2008/03/22/the-first-rule-of-programming-its-always-your-fault/comment-page-1/#comment-85 Didier Stevens Sat, 22 Mar 2008 19:11:01 +0000 http://www.mikeandrews.com/2008/03/22/the-first-rule-of-programming-its-always-your-fault/#comment-85 About hooking: you've heard about Microsoft's Detours research project? <i>Detours is a library for instrumenting arbitrary Win32 functions on x86, x64, and IA64 machines. Detours intercepts Win32 functions by re-writing the in-memory code for target functions. The Detours package also contains utilities to attach arbitrary DLLs and data segments (called payloads) to any Win32 binary.</i> About hooking: you’ve heard about Microsoft’s Detours research project?

Detours is a library for instrumenting arbitrary Win32 functions on x86, x64, and IA64 machines. Detours intercepts Win32 functions by re-writing the in-memory code for target functions. The Detours package also contains utilities to attach arbitrary DLLs and data segments (called payloads) to any Win32 binary.

]]>