I drove against a wall again and need your help with some low-level stuff. I already succeeded in hooking exported DLL-Functions ([with this code btw.](https://web.archive.org/web/20100610091602/http://newgre.net/ncodehook)) by injecting them into my target process (e.g. I can easily detour `MessageBoxW` from `user32.dll`). Unfortunately I aim for a different scenario: I have to detour a **function defined inside the executable** I'm injecting my code into. The application is Open-Source so I know everything about the function I'd need for hooking it, but the binary is signed with a certificate so I can not compile my own version. Is it possible to fetch the functions' address at runtime or detour it with another technique? The target is a "normal" 32bit Windows binary btw. nothing special I thought ;)

Yours,
Nefarius

**EDIT:** maybe due to my lame English I was not detailed enough, so here a little sample code:

```
int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd )
{
    foo();
}

BOOL foo(char* someData)
{
    return printf("%s", someData);
}

```

Now I want to detour the function `foo()` which does not exist in a dynamic library. This is my problem. I don't know how and I'm not sure if this works like I think it does.

**EDIT:** Now I know it is possible, so the important question changed to: how? How do I get the information I need; the functions address?