Coding the Wheel

Killing the Pesky Detours Marker DLL

Thursday, August 20, 2009

The current version of Microsoft Detours injects a marker DLL into detoured processes. From the help docs:

The detoured.dll file is a marker that guides Microsoft technical support personnel and tools, like Windows OCA, by helping them quickly determine that a process has been altered by the Detours package.

If you're using Microsoft Detours in the context of an online poker bot or other real-time online poker tool...this can be an issue. You might as well hang a sign around your neck:

HEY! Unauthorized software being run here! Suspicious activity! Flag me!

That's not to say that every use of Microsoft Detours in an online poker context is suspicious or malicious, but generally speaking, only three kinds of poker applications require Detours-like functionality:

  • Online poker bots
  • Data miners
  • Other real-time online poker tools

So from the perspective of an online poker site, the presence of DETOURED.DLL in a given poker client process can and should be interpreted as "suspicious". That said, earlier versions of Detours (pre-2.0) didn't include this marker DLL, and luckily the current version doesn't have to, either.

Instructions for removing the Detours marker DLL

Better yet, you can just use an equivalent open-source library like EasyHook. But whatever you do, don't make the mistake of assuming that you've "stealthed" or "cloaked" your use of API hooking by this simple expedient. You haven't; not by a long shot.

But it's a step in the right direction...

[Hat tip to Dave for the link.]

Tags: Microsoft Detours, poker bot, stealth

10 comment(s)

Awesome. I've been using an ancient version of Detours specifically so I don't have to deal with the marker DLL. I'll have to try this, but your EasyHook link looks even better.

JeremyX on Thursday, August 20, 2009

I started using EasyHook a few months ago, actually, here are a few tips for others who may have gone this route:

  1. Download EasyHook and get it building.
  2. Go through and rename internal functions/structures/etc.
  3. Use that in your poker bot/tool.

That way, not only is there not a marker DLL, but there aren't any well-known symbols/APIs floating around in your binary for the poker client to detect.

Anonymous Coward on Thursday, August 20, 2009

Another option (instead of bundling Detours/EasyHook into your bot) is to just cut and paste the specific pieces of code you need to set up the detours. That way, no identifiable functions or names in your EXE.

I'm not sure if poker clients look for that sort of stuff but better safe than sorry, right?

Teddy KGB on Thursday, August 20, 2009

Are you planning any more posts on stealthing in general? I really have no idea what they look for.

I've gone down the screen scraping path (which was actually pretty easy). Does that make me stealthier? Or can the poker sites easily determine that I'm taking an unusually large amount snapshots?

And what about input? I read on pokerstars.com that they allow betting macros as long as a human is making the decision. Does that mean I don't have to worry about stealthing my fake mouse clicks etc?

thewee on Thursday, August 20, 2009

Yeah, tons of people use AHK macros so I can't imagine that's against the rules.

Anonymous Coward on Friday, August 21, 2009

Thanks James, I've been playing around with EasyHook for about a day and so far I love it. Better than Detours in just about every way!

Ed K. on Sunday, August 23, 2009

I don't begin to use the new version of Microsoft Detours. Thank you for the tips! latex mattress

Susancai on Wednesday, October 20, 2010

The new version of Microsoft Detours is awesome. Can't wait to use it. cricket phones

Susancai on Thursday, October 28, 2010

Really valuable written content. the information that you shown is amazing and many prominently i liked the way you provided things here. Extremely, the concept is real time applicable and as per the current demand of the internet user society. Casino Time

marolon on Tuesday, December 07, 2010

This site is too popular, I wouldn't be surprised if the programmers of Poker Sites read it every day for what we that we think is stealth and safe.

Steasy on Monday, January 03, 2011

Use the form below to leave a comment.

Site Robot on just now!





Subscribe to Coding the Wheel over email or through any RSS reader. Coding the Wheel has been published since 2008.

Home | About | Contact | Subscribe Copyright © 2011 | All Rights Reserved