Can we hook some func in another process then change return address?

[Teerayoot]

Thank you,Viasek for infos.

Ok,anyway can we hook System api like

"NtQueryInformationProcess" that getprocaddressed in normal process?

Note : I using madcodehook very easy and painless.

Injecting a DLL into another process can be done quite easily with the regular Windows API only:
-first allocate memory in the target process with CreateRemoteThread,
-then copy some loader code and the arguments using WriteProcessMemory,
-then use CreateRemoteThread to start the loader code, which in turn calls LoadLibrary

This technique is very generic, and allows to execute any code into any process... This is useful for hooking as well, as it allows to hook only a specific process instead of the whole system....

in ntdll.dll
you can find return address and simple you can hook them,
the address from my ntdll.dll

;Native API
SYSTEM_CALL equ 7FFE0300h
NtAllocateVirtualMemory equ 77F5b54Eh