[lady_godiva]

Sorry, my bad, it is not the first line. Using a debugger which can handle dll (OllyDbg for example) you should be able to search for a JMP ESP command that is located at some address (you can see it with the debugger) and then use that address. The method works on Windows XP SPx as they do not randomize dll location. Win Vista and further implements ASLR which basically randomize each time the memory location which dll are loaded. There is a workaround for this and i'm going to write it as soon as i have time to do it. Despite that users32.dll even if in windows Vista or further will contain a JMP ESP command (if you can't find it let me know and i'll show you with some screenshot)