This question makes no since! What do you mean by "...someone what the address is." Either the code knows what the address is or it doesn't. You might know what the address is at a given run of the program and your debugger might give you the same address every time you rebuild, until you modify the code. But the address may be relitive to the base address of your program or it may be allocated (could be anywhere). You should never need to know the actual address (except maybe when debugging). Pattern searching has nothing to do with finding an address. /* in C */ struct whatever {...}; struct whatever* pAddr; /* uninitialized pointer/address */ or myfunct(struct whatever* pAddr) { /* modify stucture whatever */ } // in C++ struct whaterver {...}; whatever* pAddr; /* uninitialized pointer/address */ or myfunct(whatever* pAddr) { /* modify stucture whatever */ } INTP

> I want to do it without making a wrapper, and without hooking GetProcAddress ... You have to modify the entry point of the original function so that it first executes a JMP instruction to your implementation. Check this link: http://www.fengyuan.com/article/wmprint.html[^] There you will find a nice user32!BeginPaint hook implementation. However, because most user32 and kernel32 functions call an appropriate function in ntdll.dll, rather than executing the 0x2E interrupt directly (like BeginPaint does), your implementation will probably differ somewhat too; it will always depend on how the entry point of the original function looks like. More useful links: 1. Intel OpCodes[^] 2. Api Hooking Revealed[^] 3. API Spying Techniques for Windows 9x, NT and 2000 [^] Regards, RK