statically placing hooks on PE file's IAT

Question

recently I started writing my own PE library for C++, and wanted to implement static IAT/EAT hooking, (basically hooking by patching the file instead of hooking at runtime), I managed to successfully iterate all the thunk data and retrieve FTs/Names etc.

So where's the issue? Well...

As you can see in this scheme, the PE Loader replaces the IMAGE_THUNK_DATA with the actual dynamic address at runtime, so, statically, you would have an offset, say 0x28010, and at runtime the PE Loader overwrites it with module_base + 0x28010, where module_base would be the dynamically obtained base address of (always as an example) USER32.dll.

If you still don't understand where I want to get; to statically hook the function I would have to do the following steps, taking as an example MessageBoxA function in USER32.dll

1. copy the original function in the main module memory (say .text section) and save the address, we're going to use this as an "original" for the detour (the original function which gets called/returned at the end of the detour, to not break anything)

2. write/patch the actual detour function in the main module memory (again, say .text section) and use the address as the detour function (the offset to replace instead of the FTs)

but then here's the problem, replacing the FTs with the detour, the PE Loader would calculate the FTs like USER32.dll + detourOffset, where it should instead calculate mainModuleBase + detourOffset.

one way to "fix" this would be replacing the FTs with the ""ready"" address, so base + detour, but we're talking about STATICALLY hooking IATs, so we dont have a base address.

Other than having to patch something that hooks the IAT at runtime, any idea how I could achieve this?