Exetools - View Single Post - Can we hook some func in another process then change return address?

#2 09-16-2004, 07:51

For injecting you can use ForceLibrary, createprocess with the suspend flag, inject, resume process.

Hooking a function is just a matter of calling WriteProcessMemory and correctly modifying a call/jmp to the address of your code, and returning properly. Make SURE you take care of the stack correctly.