Breakpoint->AddBreakpoint( 0x0070A706, (DWORD)hook_WardenAlloc ); DWORD dwSize = 0, dwBase = 0, dwOrig = 0x0070A718; void __declspec( naked ) hook_WardenAlloc() { _asm { pushad mov esi, [ esi + 4 ] mov dwSize, esi popad mov dwBase, eax } dwBase = (DWORD)VirtualAlloc( 0, dwBase, 0x1000, 4 ); /*push 4 push 1000 push eax push 0 call VirtualAlloc mov dwBase, eax*/ _asm { mov eax, dwBase mov dword ptr ds:[esi], eax jmp dwOrig } /* 0070A706 > 6A 04 PUSH 4 ; /Protect = PAGE_READWRITE 0070A708 . 68 00100000 PUSH 1000 ; |AllocationType = MEM_COMMIT 0070A70D . 50 PUSH EAX ; |Size 0070A70E . 6A 00 PUSH 0 ; |Address = NULL 0070A710 . FF15 58218300 CALL DWORD PTR DS:[<&KERNEL32.VirtualAlloc>] ; \VirtualAlloc 0070A716 . 8906 MOV DWORD PTR DS:[ESI],EAX */ }