ocr: Target Process USER32.DLL import Real Address Address Table of GetMessage (function Save allregisters GetMessage pointers) code Push arguments (function.name, byte params, etc.) on stack JMP OWORD call LogFunctionCall0) PTR XXXXXXXX) Restore all registers JMP (YYYYYYYY) GetMessage" Byte encoded: param info GetMessage Call to GetMessage. in program Array of pointers to API interception stubs (built by LOADAPI5.C/INTRCPL.C) Figure 4 Spy DLL Builds a Stub for GetMessage
