Hello,

I am trying to use the Microsoft Detour's package and prove that I am successfully able to intercept Win32API calls that might have been injected by a malicious code into my exe.

I was able to statically insert some new Win32API calls in my app using OllyDbg. But I am also trying to dynamically insert a few Win32API calls into my exe to prove that I can detect the anomaly using the Detours package.

This is where I am stuck..I am unable to find help on how to modify the exe after it has been loaded in the memory. I know how to modify the exe before it is loaded.

Hope my question was clear enough :-)

Thanks for any help,
Subha

Have you looked at any of the process patchers? It might be cumbersome to add enough patches to do what you are trying, but (AFAIK) they all perform patching on the code after loading into memory but prior to the start of execution.

Personally I like R!SC's Process Patcher for the small stuff I do...

Check The Governor. It is using Detours to WoW.

http://www.rootkit.com/newsread_print.php?newsid=371

Tom