Every WindowsNT box has a NSA trojan called _Total.exe which is loaded by kernel itself, it can override any user functions and start spying on command.
Name:
Anonymous2009-02-04 7:17
>>5
In fact, that works pretty well for bypassing hack protection in MMOs too. Just write a dll that has those 5 bytes and a jump to the original function +5 and voila, Mr. Hackprotection won't recognize your API-call anymore.