Class 07 · KP 07 / 19

Inline (Trampoline) Hooking: Idea

IAT hook: overwrite the import pointer so calls jump to your handler.

Patch the target function itself, not a caller's table.
Overwrite the first N bytes of the API with a jmp detour.
Save the overwritten (original) bytes into a trampoline so you can still invoke the real function.

Every caller — static import, GetProcAddress, or ordinal —

ends up executing the same first bytes. Patch there once and you catch

them all.