The current version of Microsoft Detours injects a marker DLL into detoured processes. From the help docs:
The detoured.dll file is a marker that guides Microsoft technical support personnel and tools, like Windows OCA, by helping them quickly determine that a process has been altered by the Detours package.
If you're using Microsoft Detours in the context of an online poker bot or other real-time online poker tool...this can be an issue. You might as well hang a sign around your neck:
HEY! Unauthorized software being run here! Suspicious activity! Flag me!
That's not to say that every use of Microsoft Detours in an online poker context is suspicious or malicious, but generally speaking, only three kinds of poker applications require Detours-like functionality:
- Online poker bots
- Data miners
- Other real-time online poker tools
So from the perspective of an online poker site, the presence of DETOURED.DLL in a given poker client process can and should be interpreted as "suspicious". That said, earlier versions of Detours (pre-2.0) didn't include this marker DLL, and luckily the current version doesn't have to, either.
Instructions for removing the Detours marker DLL
Better yet, you can just use an equivalent open-source library like EasyHook. But whatever you do, don't make the mistake of assuming that you've "stealthed" or "cloaked" your use of API hooking by this simple expedient. You haven't; not by a long shot.
But it's a step in the right direction...
[Hat tip to Dave for the link.]
Posted by James Devlin 10 comment(s)
