system wide api hook
 

What is the best way to do system wide user mode (NOT KERNEL MODE) api hook on Windows NT?

Re: system wide api hook
 

Re: system wide api hook
 

thanks, but I'm not interested in these hooks (like keyboard hooks, mouse event hooks, etc.)
I need to intercept/hook every call to a certain win32 api function on the system
How do I do that (without modifing the dll files on disk)?

Re: system wide api hook
 

you can use the WH_CALLWNDPROC hook if the process you want has a window. Other than that, I don't know if its even possible to do what you want.

Re: system wide api hook
 

One way might be: open every process, find if they import that particular function, if they do find where they call it and idk you solve the rest.