title: Waiting for a program to load DLLs and then suspend it
body: <p>I want to hook an api as soon as a program loads. For that I use createprocess with the appropriate flag set so that the process is created suspended. I place the hook and then I resume it. But when I try to hook an api that's not from ntdll.DLL i get an ERROR_INVALID_ADDRESS (487). If I wait until the program has started to place the hook, I can do it without trouble.</p>
  
  <p>This leads me yo believe that the process doesn't load every DLL when it starts (even though they are linked statically), and there is some initialization to be done before the memory area on the iat that corresponds to the api I want to hook, is valid and ready to be accessed.</p>
  
  <p>Am I right here? And if so, what can I do in order to know when to place the hook?</p>
  
  <p>Thanks!</p>
  
  <p>PD: I'm working on a proof of concept for my future thesis. It's purely for educational purposes.</p>
  
  <p>PD2: I hooked the entry point and it worked great but now I have another conundrum: I need a standardized way of knowing the entry point of a loaded process. </p>