Topic created on: November 23, 2008 18:49 CST by Kalagaraz .

I'm trying to learn function hooking and while learning I was just trying to hook some simple functions in Windows Vista Minesweeper.exe. I've run across a weird problem though.

When I first disassemble minesweeper.exe with IDA Pro I get this:

.text:0101FED4 ; public: static void __stdcall UIDialogs::StartAboutDialog(void)

Trying to hook this address though never worked. So I decided to set a breakpoint there and launch it with IDA Pro debugger. When I started the about box, it broke here:

.text:00CAFED4 ; public: static void __stdcall UIDialogs::StartAboutDialog(void)

Why did the address change? Also 00CAFED4 is the correct address as I can hook it. I got a friend to try this on his computer, and his started with the same address, but when debugging his broke at 00C1FED4. Is there any way to predict the real address of the function without acctually debugging it?

Thanks in advanced,
Kalagaraz