filprofiler icon indicating copy to clipboard operation
filprofiler copied to clipboard

Windows support

Open itamarst opened this issue 3 years ago • 2 comments

What needs doing:

  • [ ] Figure out how to hook APIs, whatever the equivalent of LD_PRELOAD is. this may involve compiling a new python.exe or something terrible like that.
  • [ ] Figure out what APIs to override and their semantics. There's malloc() etc. but presumably Windows has its own APIs too?

https://microsoft.github.io/mimalloc/overrides.html might be useful for understanding what to do.

itamarst avatar Jul 18 '20 10:07 itamarst

Other resources

  • AppInit_DLLs
  • https://github.com/microsoft/detours
  • https://en.wikipedia.org/wiki/DLL_injection
  • https://github.com/sengelha/win32-ldpreload
  • https://trello.com/c/OCsvFVJp/167-ldpreload-eq-for-windows-api-hooking

itamarst avatar Jul 18 '20 11:07 itamarst

Another option is https://github.com/frida/frida-rust whihc is maybe cross-platform overriding.

itamarst avatar Jul 12 '22 01:07 itamarst