system wide api hook

[denis1401]

What is the best way to do system wide user mode (NOT KERNEL MODE) api hook on Windows NT?

[Ancient Dragon]

windows hooks

[denis1401]

thanks, but I'm not interested in these hooks (like keyboard hooks, mouse event hooks, etc.)
I need to intercept/hook every call to a certain win32 api function on the system
How do I do that (without modifing the dll files on disk)?

[Ancient Dragon]

you can use the WH_CALLWNDPROC hook if the process you want has a window. Other than that, I don't know if its even possible to do what you want.

[MosaicFuneral]

One way might be: open every process, find if they import that particular function, if they do find where they call it and idk you solve the rest.