Recap: The Import Address Table (IAT)

• When a PE loads, the loader resolves each imported API and writes its real address into the module's IAT.
• A call like call MessageBoxW compiles to an indirect call: call [IAT_slot].
• That slot is just a pointer in writable memory — change the pointer, change where the call goes.

The opportunity

We never touch user32.dll. We only overwrite the caller

module's IAT slot for MessageBoxW.