// the take
A grab-bag of small Windows-internals demos from 2013: injecting LoadLibrary into a remote process, hooking the MSVCR90 exception dispatcher with Detours, and a standalone Vectored Exception Handler (VEH) example. It's for someone learning or reverse-engineering Windows process injection and SEH/VEH internals on 32-bit Windows, not for use in a real product.
- The VEH and exception-dispatcher hooking code is a clean, small illustration of how Windows structured/vectored exception handling actually dispatches, which is otherwise scattered across MSDN and blog posts
- Uses Microsoft Detours for the inline hooking in Msvcr90_Exception rather than hand-rolled trampolines, so the hooking logic itself is correct and battle-tested
- Each technique (LoadLibrary injection, exception hooking, VEH) is its own isolated VS project, so you can read and run one concept without the others getting in the way
- Last commit is from 2013 and targets MSVCR90 (VS2008's CRT) specifically — on any modern Windows/VS toolchain the exception dispatcher hooking logic won't find its target and just won't work
- Ships prebuilt detours.lib and ntdll.lib binaries in the repo instead of building from source, so you're trusting a 13-year-old binary blob with no way to verify what's actually in it
- LoadLibrary injection and exception-dispatcher hooking are textbook techniques used by malware and AV products alike — there's no sandboxing or safety guard here, it's raw injection code, so treat it as a reference to read, not something to run against a process you care about
- No build instructions beyond raw .vcproj/.sln files tied to an old Visual Studio version; getting this to even compile today will take more effort than the code itself teaches you
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →