You essentially replace a function with your own. The project is at https://github.com/microsoft/Detours https://github.com/microsoft/Detours. I’ve created a P

You essentially replace a function with your own. The project is at https://github.com/microsoft/Detours https://github.com/microsoft/Detours. I’ve created a PowerShell module that wraps this library to make it easier to hook functions on the fly for testing https://github.com/jborean93/PSDetour https://github.com/jborean93/PSDetour. For example I used it to capture TLS session data for decryption https://gist.github.com/jborean93/6c1f1b3130f2675f1618da56633eb1fa https://gist.github.com/jborean93/6c1f1b3130f2675f1618da5663... as well as create an strace like functionality for various Win32 APIs (still expanding as I find more use cases) https://github.com/jborean93/PSDetour-Hooks https://github.com/jborean93/PSDetour-Hooks