What does DetourAttach(&(PVOID &)BindKeyT, BindKeyD); mean? Attaching a detour to a memory address...

Question

Hello everyone!

This is just a simple question. I've been reading the source of something which attaches to a memory address of a subroutine using DetourAttach(&(PVOID &)BindKeyT, BindKeyD); where BindKeyT is the address to a subroutine in memory. I'm curious, what exactly does (&(PVOID &) mean in english? I understand that PVOID is a void pointer, but how does this get translated into a function which can be used to attach a detour to?

Answer 1

The C++ parser in my head (which is not bug free) says that it is a C style cast of BindKeyT to a reference to a pointer to void - the (PVOID&) part - and then taking the address of that - the & in front. So the result of the expression is a pointer to a pointer to the function.

Answer 2

There is an introduction to Detours here: api-hooking-with-detours-part-1

Answer 3

Terry Mahaffey is right, what you are passing is a pointer to a pointer to the function. This is commonly used whenever the function you are passing the pointer to (in this case, DetourAttach) wants to return more than one value, and one of those returned values is a pointer. Since functions in C/C++ can only return a single value, the only way to obtain multiple values from them is via pointers.

A simple example would be when one wishes to return a pointer to a block of allocated memory. Then one can write a function like:

int allocstr(int len, char **retptr)
 {
  char *p = malloc(len + 1); /* +1 for \0 */
  if(p == NULL)
   return 0;
  *retptr = p;
  return 1;
 }

To answer your other question, of how to setup a memory address to be used as a function, one can do it like so:

void* (void * BindKeyT)(const char* key) = actual_BindKeyT;

// actual_BindKeyT is a pointer to a function that will be defined elsewhere, 
// and whose declaration you will include in your project through a header file
// or a dll import

void * BindKeyD(const char* key)
{
    // Code for your hook function
}

DetourAttach(&(PVOID&)BindKeyT, BindKeyD);

(taken from http://zenersblog.blogspot.com/2008/04/api-hooking-with-detours-part-1.html)

Bear in mind that the declarations for BindKeyT and BindKeyD should match.