| 摘要 |
Intercepting calls to document production functions. In one embodiment of the application, an import address table for the application is accessed, document production functions being supplied by an operating system are identified within the import address table. For each identified document production function, an address associated with that function in the import address table is replaced with an address to be used to access a proxy document production function. In another embodiment, the application is loaded in debugging mode. Once the import address table for the application has been populated with addresses for functions called by the application, the execution of the application is paused. An address, in the import address table, associated with a document production function to which calls from the application are to be intercepted is replaced with an address to be used to access a proxy document production function. Execution of the application is then resumed.
|
