Detours is a library for instrumenting arbitrary Win32 functions Windows-compatible processors. Detours intercepts Win32 functions by re-writing the in-memory code for target functions. The Detours package also contains utilities to attach arbitrary DLLs and data segments (called payloads) to any Win32 binary.

Detours preserves the un-instrumented target function (callable through a trampoline) as a subroutine for use by the instrumentation. Our trampoline design enables a large class of innovative extensions to existing binary software.

https://www.microsoft.com/en-us/research/project/detours/

Interesting. Has anyone done the same thing on Linux?

I use and recommend subhook[0].

[0] https://github.com/Zeex/subhook

Only for the record, there is also easyhook:

https://easyhook.github.io/

https://easyhook.github.io/#features

https://github.com/EasyHook/EasyHook

And my more sophisticated library, https://github.com/stevemk14ebr/PolyHook_2_0

You essentially replace a function with your own. The project is at https://github.com/microsoft/Detours.

I’ve created a PowerShell module that wraps this library to make it easier to hook functions on the fly for testing https://github.com/jborean93/PSDetour. For example I used it to capture TLS session data for decryption https://gist.github.com/jborean93/6c1f1b3130f2675f1618da5663... as well as create an strace like functionality for various Win32 APIs (still expanding as I find more use cases) https://github.com/jborean93/PSDetour-Hooks

> as well as create an strace like functionality for various Win32 APIs

Yes please. Thank you for this