How to Modify Import Address Table for Run time Loaded DLL

Question

I want to hook functions that are called from a loaded DLL on Run time, i used the class CAPIHook from the book \"Windows Via C/C++\" (the DLL Injecting done by Install Syst

Answer 1

I've done this before. What you want is EAT hooking instead of IAT. Also, hook the ::LoadLibrary API itself so you know when the DLL is loaded, and hook the requested api from the DLL after it is loaded.

There are some examples on the Internet on how to do this. Here is one I found just now: http://board.cheat-project.com/showthread.php?t=10633