jborean93 / PSDetour

Windows Detour Hooking in PowerShell

PSDetour

Hook C APIs in PowerShell as well as run PowerShell in other local processes. See about_PSDetour for more details. See PSDetour-Hooks for some hooks that can be used with Trace-PSDetourProcess.

Documentation

Documentation for this module and details on the cmdlets included can be found here.

This module is highly experimental and misuse can crash the process you are hooking. Currently it can only target x64 based processes on Windows.

Requirements

These cmdlets have the following requirements

• PowerShell v7.2 or newer
• Windows Server 2008 R2/Windows 7 or newer

Installing

The easiest way to install this module is through PowerShellGet.

You can install this module by running;

# Install for only the current user
Install-Module -Name PSDetour -Scope CurrentUser

# Install for all users
Install-Module -Name PSDetour -Scope AllUsers

Contributing

Contributing is quite easy, fork this repo and submit a pull request with the changes. To build this module run .\build.ps1 -Task Build in PowerShell. To test a build run .\build.ps1 -Task Test in PowerShell. This script will ensure all dependencies are installed before running the test suite.