the EncodePointer() isn't exported from kernel32.dll on windows 2k
True. It isn't available until Windows XP SP2 according to MSDN
when an application runs on windows 2k and call EncodePointer
If it doesn't exist which you've previously described then how can you call it? Not sure if I follow.
Do you mean another kernel32.dll from a different directory exporting a function named EncodePointer?
If so then yes, but unless you're posing as another module with the same function name it makes no sense to me
considering it's not available to call before XP SP2.
If the API doesn't exist it cannot be hooked. If it exists in a newer OS version or service pack then the hook is set.
--Iconic