Established: January 16, 2002

Detours is a software package for re-routing Win32 APIs underneath applications. Under commercial release for over 10 years, Detours is licensed by over 100 ISVs and used within nearly every product team at Microsoft.

What's New

What’s New?

Build 343 of Detours 3.0 is now available. Detours Build 338 and later fix a security vulnerability that has been identified in releases of Detours before 3.0 Build 334.

Detours Professional 3.0 is available for commercial use. The Professional licenses allows the use of Detours in commercial products and in production environments.  Detours Professional includes support for either 32-bit or 64-bit processes on x86 and other Windows-compatible processors. For more information on licensing Detours Professional 3.0, contact us via email.

Detours Express 3.0 is available for immediate download under a no-fee license for research, non-commercial, and non-production use. Detours Express may be used to prototype (but not deploy) commercial projects.

The APIs in Detours Professional 3.0 and Detours Express 3.0 are identical.  The two versions differ only in their licensing .  Detours Professional is required for all commerical or production deployments.  Detours Professional 3.0 and Detours Express 3.0 both support x86, x64, IA64, and ARM processors. 

Detours 3.0 includes the following new features over Detours 2.x:

  • Support for 64-bit code on x64 and IA64 processors (Professional Edition only).
  • Support for all Windows processors (Professional Edition only).
  • Removed requirement for including detoured.dll in processes.
  • Compatibility improvements for detouring APIs used by managed-code (MSIL) programs, especially on x64 processors.
  • Addition of APIs to enumerate PE binary Imports and to determine the module referenced by a function pointer.



Innovative systems research hinges on the ability to easily instrument and extend existing operating system and application functionality. With access to appropriate source code, it is often trivial to insert new instrumentation or extensions by rebuilding the OS or application. However, in today’s world systems researchers seldom have access to all relevant source code.

Detours is a library for instrumenting arbitrary Win32 functions Windows-compatible processors. Detours intercepts Win32 functions by re-writing the in-memory code for target functions. The Detours package also contains utilities to attach arbitrary DLLs and data segments (called payloads) to any Win32 binary.

Detours preserves the un-instrumented target function (callable through a trampoline) as a subroutine for use by the instrumentation. Our trampoline design enables a large class of innovative extensions to existing binary software.

We have used Detours to create an automatic distributed partitioning system, to instrument and analyze the DCOM protocol stack, and to create a thunking layer for a COM-based OS API. Detours is used widely within Microsoft and within the industry.