Questions again on howto hide APISPY32?

Boya,

Apisyp32 works by modifying the import table on the target application. In your case you are trying to spy on an application which doesnt have a valid import table. You cannot use apisyp32.

You can try the followig if you have time and programming interest:

1. start the target application as child process with debug enabled.
2. In dll load event if you need to monitor the functions in the dll, insert cc (int 3) as the first byte for all the exported functions. store the original byte and the address .
3. whenever you get a debug breakpoint event check whether the eip in the target process is in your stored addresses. If yes then log the name in a file. Reset the original byte at the particular address and enable single-step by modifying the control registers. you will receive a sigle step breakpoint event again. there you can insert cc (int 3) instruction for next breakpoint and proceed.

I did this long ago. I dont know whether i still have the program with me. If i find it i will send it to you.

regards,
VGSHADOW