currently running code is protected to prevent virus etc from causing problems.
however you can still access it:Strict Framework brl.blitz 'here we create a new bit of code in a temporary memory area: Local PrepareArea:Byte Ptr = MemAlloc ( 7 ) PrepareArea [ 0 ] = 184 'mov eax,_RedirectFunc ( Byte Ptr Ptr ( PrepareArea + 1 ) ) [ 0 ] = RedirectFunc PrepareArea [ 5 ] = 255 'jmp eax (part 1) PrepareArea [ 6 ] = 224 'jmp eax (part 2) 'now we want to copy our new created function to the executable memory 'it should replace the String.FromWString function: 'MemCopy String.FromWString , PrepareArea , 7 'doesn't work, use this instead: WriteProcessMemory GetCurrentProcess ( ) , String.FromWString , PrepareArea , 7 , Null 'works 'now let's just try to call String.FromWString and see what happens instead: WriteStdout String.FromWString ( "Hello".ToWString ( ) ) + "~n" Function RedirectFunc$ ( Param:Short Ptr ) WriteStdout "Someone tried to call String.FromWString!~n" WriteStdout "String.FromWString was called with the following pointer as parameter:~n" WriteStdout Int Param + "~n" Return "This is the return value...." EndFunction Extern "Win32" Function GetCurrentProcess ( ) Function WriteProcessMemory ( DstProc , Dst:Byte Ptr , Src:Byte Ptr , Size , Written Ptr ) EndExternThis protection isn't valid for the OS, since api functions belong to the os you can use them to access this memory.