To answer the original question, what you can do is to hook LdrpCallInitRoutine in . This function is used by DLL loading/unloading code to actually call the DLL entry point () and also the TLS callbacks. The first argument is the address to be called:ntdll.dllDllMain
