How to identify the address where the test is done?

[bongos_man]

i didn't have a chance to look at your exe, but say a target calls strcmp and then does something based its result. your loader (which injects a dll with your code) can use WriteProcessMemory to patch the call to strcmp (in your target) to instead call the function in your dll. your function can then modify the string and return strcmp(s1, s2). the tutorials show you how can calculate the address of the dll function so that you can patch the call with the right address.