As the title says I'm trying out some code injection. My goal is to replace a function in a game so that I can play it in different ways.

I'm not honestly sure if this is the right place to post this sort of thing, but any help in finding where I could get aid would be appreciated.

The type of injection that is being used is with SetWindowsHookEx the target method to be replace is Direct3DCreate9. The problem seems to be that the application is not loading D3D9.dll itself but is loading a dll called SFMiddleWare and that dll is what loads D3D9.

Currently I'm overwriting LoadLibraryA with my own so that I can catch when SFMiddleWare is loaded and immediately after its done I try to replace Direct3DCreate9.

Some things that are being assumed is:
D3D9.dll will be in the IAT after SFMiddleWare.dll is done being loaded
And that LoadLibrary will not spawn any threads so that I could do something like

myLoadLib( fileName)
hresult r = LoadLibrary(fileName);
myHook(-HookStructForD3D-);
return r;

Thanks in advance

what's your question?

How to get an App's IAT to point to one of my functions.

What was making it complicated was that the specific function is not in the App's IAT but in a DLL's IAT that was loaded through LoadLibrary.

ex:
In the App's IAT there was = Kernel32.dll, User32.dll.
During execution SFMiddleWare.dll was loaded through the use of LoadLibrary, making sure that the function I wanted would not be in the App's IAT.

But using a PE viewer I could see that the target function was in the IAT of SFMiddleWare.dll.

What I wound up doing was just making a proxy DLL.

i'm glad it worked out