[Silvers]

Have done this several times. Only need to wildcard first 6 bytes. Suggest wildcard both signatures so load order isn't a factor. Unloading you raise a good point, but who really unloads extensions anyway?

Maybe alloc some memory to maintain a list of different detours and point to that. If any of the first 6 bytes don't match the original expected bytes then we have a ptr to list. Check the list for bytes which indicate a detour and have it call each one as required. Then you can safely remove the detoured addresses from the list. Something like that, don't know how possible, just an idea.