i am looking to expand my knowledge so i can someday(hopefully within few months) be able to join the reverse engineering community, probably in the anti-virus/defense field.

i was wondering, since it is not easy to find information regarding those topics: is there a book(preferably modern) or a course that teaches important and vital subjects such as detour and code injections? i am really enthusiastic with this field and i really eager to study as much as possible to improve and be efficient so i could help a lot of people in this important field.

however, sadly, after many searches, i found it to be extremely hard to locate information on those subjects, let alone modern information. so i'd like to request your help with it.

p.s: if no book/course available, even resources on the web will be gems to me.

  • 1
    Code injection and detouring in what environment? What is the system of interest?
    – julian
    Commented Dec 18, 2019 at 11:16
  • in windows/linux. if there's a material related to ARM, it would help a lot too. doesn't matter if it is x86 or x86-64 architecture
    – newB
    Commented Dec 20, 2019 at 6:37

2 Answers 2


Practical Binary Analysis by Dennis Andriesse is great, the examples are mostly done on Linux but the concept is still the same for Windows.


Detouring is more or less a patching of the .text section inside of a program. It's practically more or less hacking, you're rerouting a program to do what you want it to do with your own function. Usually by placing the opcode 0xE9 (known as JMP, also added with some 0x90 which is NOP, for alignment) inside of the memory address you're detouring, that JMPs to your personal function you wrote.

I recommend reading up on x86 Assembly, along with detouring itself. It's a pretty basic topic once you get it down, but it's definitely a struggle to start learning.

Resources to get you started: Detour Video by Guide Virginia EDU for x86 Assembly

  • It is not the complete answer though, since you can detour not by inline assembly jumps, but by using higher level detour function to hook to the original function address and then point to your hooked version, which might be as complex as you wish it to be and does not resolve to simple byte hacking...
    – Irbis77
    Commented Sep 29, 2021 at 9:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.