What is the best way to do system wide user mode (NOT KERNEL MODE) api hook on Windows NT?
thanks, but I'm not interested in these hooks (like keyboard hooks, mouse event hooks, etc.)
I need to intercept/hook every call to a certain win32 api function on the system
How do I do that (without modifing the dll files on disk)?
you can use the WH_CALLWNDPROC hook if the process you want has a window. Other than that, I don't know if its even possible to do what you want.
One way might be: open every process, find if they import that particular function, if they do find where they call it and idk you solve the rest.