We were very lucky that we had symbols for global things, which inludes function names and signatures but not return types. We then replaced the first instruction of a function with a jump to our own. global variables can be done with a reference to a raw address. virtual methods are a bit of a challenge but we found way to handle them.