Killing the Pesky Detours Marker DLL

Thursday, August 20, 2009

The current version of Microsoft Detours injects a marker DLL into detoured processes. From the help docs:

The detoured.dll file is a marker that guides Microsoft technical support personnel and tools, like Windows OCA, by helping them quickly determine that a process has been altered by the Detours package.

If you're using Microsoft Detours in the context of an online poker bot or other real-time online poker tool...this can be an issue. You might as well hang a sign around your neck:

HEY! Unauthorized software being run here! Suspicious activity! Flag me!

That's not to say that every use of Microsoft Detours in an online poker context is suspicious or malicious, but generally speaking, only three kinds of poker applications require Detours-like functionality:

  • Online poker bots
  • Data miners
  • Other real-time online poker tools

So from the perspective of an online poker site, the presence of DETOURED.DLL in a given poker client process can and should be interpreted as "suspicious". That said, earlier versions of Detours (pre-2.0) didn't include this marker DLL, and luckily the current version doesn't have to, either.

Instructions for removing the Detours marker DLL

Better yet, you can just use an equivalent open-source library like EasyHook. But whatever you do, don't make the mistake of assuming that you've "stealthed" or "cloaked" your use of API hooking by this simple expedient. You haven't; not by a long shot.

But it's a step in the right direction...

[Hat tip to Dave for the link.]

Tags: Microsoft Detours, poker bot, stealth

10 comment(s)

Awesome. I've been using an ancient version of Detours specifically so I don't have to deal with the marker DLL. I'll have to try this, but your EasyHook link looks even better.

I started using EasyHook a few months ago, actually, here are a few tips for others who may have gone this route:

  1. Download EasyHook and get it building.
  2. Go through and rename internal functions/structures/etc.
  3. Use that in your poker bot/tool.

That way, not only is there not a marker DLL, but there aren't any well-known symbols/APIs floating around in your binary for the poker client to detect.

Another option (instead of bundling Detours/EasyHook into your bot) is to just cut and paste the specific pieces of code you need to set up the detours. That way, no identifiable functions or names in your EXE.

I'm not sure if poker clients look for that sort of stuff but better safe than sorry, right?

Are you planning any more posts on stealthing in general? I really have no idea what they look for.

I've gone down the screen scraping path (which was actually pretty easy). Does that make me stealthier? Or can the poker sites easily determine that I'm taking an unusually large amount snapshots?

And what about input? I read on that they allow betting macros as long as a human is making the decision. Does that mean I don't have to worry about stealthing my fake mouse clicks etc?

Yeah, tons of people use AHK macros so I can't imagine that's against the rules.

Thanks James, I've been playing around with EasyHook for about a day and so far I love it. Better than Detours in just about every way!

I don't begin to use the new version of Microsoft Detours. Thank you for the tips! latex mattress

The new version of Microsoft Detours is awesome. Can't wait to use it. cricket phones

Really valuable written content. the information that you shown is amazing and many prominently i liked the way you provided things here. Extremely, the concept is real time applicable and as per the current demand of the internet user society. Casino Time

This site is too popular, I wouldn't be surprised if the programmers of Poker Sites read it every day for what we that we think is stealth and safe.

Use the form below to leave a comment.

Coding the Wheel has appeared on the New York Time's Freakonomics blog, Jeff Atwood's Coding Horror, and the front page of Reddit, Slashdot, Digg.

On Twitter

Thanks for reading!

If you enjoyed this post, consider subscribing to Coding the Wheel by RSS or email. You can also follow us on Twitter and Facebook. And even if you didn't enjoy this post, better subscribe anyway. Keep an eye on us.

Question? Ask us.



Coding the Wheel =
Code, poker, technology, games, design, geekery.


You've read our technical articles, you've tolerated our rants and raves. Now you can hire us anytime, day or night, for any project large or small.

Learn more

We Like

Speculation, by Edmund Jorgensen.