Intercepting function cells

A method for intercepting a function call from an application, comprising:

• loading the application in debugging mode;
• detecting when the application's import address table has been updated to include addresses for functions provided by the slave module and then pausing the execution of the application;
• replacing an address in the import address table used to access a function provided by a slave module with an address to be used to access a proxy function provided by a proxy module;
• and
• resuming execution of the application after the address for the function provided by the slave module has been replaced.

Computer readable media having instructions for:

• loading a bootstrap code into the memory space of an application;
• accessing the application's import address table;
• replacing, in the import address table, an address used to access a function called early in the execution of the application with an address used to access the bootstrap code;
• replacing an address in the import address table used to access a function provided by a slave module with an address to be used to access a proxy function provided by a proxy module;
• wherein the bootstrap code includes instructions for loading the proxy module into the memory space of the application and to make a call to the function called early in the execution of the application.

Computer readable media having instructions for:

• loading an application in debugging mode;
• detecting when the application's import address table has been updated to include addresses for functions provided by the slave module and then pausing the execution of the application module;
• replacing an address in the import address table used to access a function provided by a slave module with an address to be used to access a proxy function provided by a proxy module;
• and
• resuming execution of the application after the address for the function provided by the slave module has been replaced.

A system for intercepting a function call made by an application, comprising:

• a module loader operable to load a proxy module into operational memory with an application;
• bootstrap code;
• a hooking module operable to load the bootstrap code into the memory space of the application, access an import address table for the application, replace, in the import address table, an address used to access a function called early in the execution of the application with an address used to access the bootstrap code;
• a reviser operable to identify an address to be used to access a proxy function provided by the proxy module, access the import address table for the application, identify in the import address table a function to which calls from the application are to be intercepted, and replace, in the import address table, an address associated with the identified function with the identified address to be used to access the function provided by the proxy module;
• wherein the bootstrap code includes instructions for loading the proxy module into the memory space of the application and to make a call to the function called early in the execution of the application and wherein the module loader, the bootstrap code, the hooking module, and the reviser are stored on one or more computer readable media.

A system for intercepting a function call made by an application, comprising:

• an application loader operable to load an application in debugging mode;
• an event detector operable to detect when the application's import address table includes an address for a function provided by a slave module;
• an execution controller operable to pause the execution of the application upon detection by the event detector and to later resume execution of the application;
• and
• a reviser operable to accessing the import address table of the application when paused and replace an address in the import address table used to access a function provided by the slave module with an address to be used to access a proxy function provided by a proxy module;
• wherein the application loader, the event detector, the execution controller, and the reviser are stored on one or more computer readable media.