I can intercept the API from a c++ application, but I'm having trouble with .net applications. With C++ apps, I just get the module handle of the .exe and I can get the correct IMAGE_IMPORT_DESCRIPTOR for the specific dll using ImageDirectoryEntryToData(). But with .net, when I use the .exe as the module handle(as handle parameter for ImageDirectoryEntryToData()), I get mscoree.dll and the api functions I want to intercept are not in that dll. Anyone know which module to look into? I'm guessing that one of them calls GetProcAddress whenever an API is called.