mov eax, [iat___2_YAPAXI_Z] mov [iat_gluOrtho2D+4], eax mov [iat___2_YAPAXI_Z], hooked_new jmp 0xa4f5e9 hooked_new: push [esp+4] call [iat_gluOrtho2D+4] add esp, 4 push [esp+4] push 0x33 push eax call [iat_memset] add esp, 12 ret // then patch entrypoint: call foo; jmp a4f5e9 -> call foo; jmp hooked_ep // also patch PE header to have .rdata writeable ('40 00 00 40 . d a t a' -> '40 00 00 c0 . d a t a')