Inline API hooking with trampoline

In the previous simple hooking function, the malware can alter the arguments of the API. But when you're using trampolines, the malware can also alter the return value of the API and any data associated with it. The trampoline is simply a small function that only executes jmp to the API and includes the first missing five bytes (or three instructions, in the previous case), like this:

Trampoline:
    mov edi, edi
    push ebp
    mov ebp, esp
    jmp API+5 ;jump to the API after the first replaced 5 bytes

Rather than jumping back to the API, which in the end returns control to the program, the hooking function calls the trampoline as a replacement of the API and the trampoline returns to the hooking function with the return value of the API to be altered by the hooking function before returning back to the program, as shown in the following screenshot:

Figure 17: Hooking function with Trampoline

The code of the hooking function looks more complex:

...